Annual Report to Parliament on the Administration of the Privacy Act 2024-2025

Introduction

The Privacy Act (Act) provides individuals with a right of access to their personal information and protects the privacy of individuals with respect to personal information under the control of government institutions.

This Annual Report was prepared in accordance with section 72 of the Act, which stipulates that annual reports on privacy shall be tabled in Parliament.

This report will be submitted and tabled in Parliament through the Minister of Public Safety Canada according to the timeline set out in section 72.

About the Civilian Review and Complaints Commission for the Royal Canadian Mounted Police

The Civilian Review and Complaints Commission for the Royal Canadian Mounted Police (CRCC) operates pursuant to the Royal Canadian Mounted Police Act, R.S.C. 1985, c. R‑10. The CRCC provides civilian review of RCMP members' conduct in performing their policing duties so as to hold the RCMP accountable to the public.

One of the CRCC's main roles is to take public complaints about members of the RCMP. These complaints are then forwarded to the RCMP for initial investigation as mandated by the Royal Canadian Mounted Police Act; however, if the complainant is dissatisfied with the response that he or she receives from the RCMP, the CRCC will review the complaint with a view to determining the reasonableness of the RCMP's response. In appropriate cases, the CRCC will undertake its own investigation or hearing into a complaint. The Chairperson of the CRCC also has the power to file his or her own complaint if he or she feels that a matter is deserving of investigation.

Additionally, even in the absence of a public complaint, the CRCC is empowered to conduct a review of RCMP activities to evaluate compliance with legislation, regulations, ministerial directions, policy, procedures and/or guidelines.

ATIP Responsibilities

At the CRCC, the Access to Information and Privacy (ATIP) Unit consisted of an ATIP Coordinator and a Junior ATIP Analyst during the reporting period of 2024-2025. Both employees process requests from the public and consultations from other departments or agencies, and participate in forums for the ATIP community. The ATIP Coordinator provides advice to CRCC employees and senior officials on ATIP-related matters, prepares annual ATIP reports, ensures the ongoing accuracy of the CRCC's Info Source, prepares completed Access to Information summaries for proactive publishing on the Open Government Portal, and monitors changes in ATIP policy, guidelines and directives. The Junior ATIP Analyst is responsible for monitoring compliance for proactive publishing at the CRCC, under Part 2 of the Access to Information Act.

When processing requests and consultations under the Access to Information and Privacy Acts, the ATIP Unit also benefits from some administrative assistance from personnel in the Information Management Unit of the CRCC and a student assistant.

The CRCC Chairperson, under delegated authority from the Minister of Public Safety, provided the final approval for all responses on ATIP requests and consultations during the first three quarters of the reporting period of 2024-2025. During the fourth quarter, the Chief Financial Officer and Senior Director of Corporate Services at the CRCC completed these approvals, as the CRCC was without a Chairperson.

During the reporting period, the CRCC was not party to any service agreements under section 73.1 of the Privacy Act.

Delegation Order

The Minister of Public Safety has delegated full authority under the Act to the CRCC Chairperson, the ATIP Coordinator, and the Chief Financial Officer and Senior Director of Corporate Services. The most recent delegation order was signed by the Minister of Public Safety on November 17, 2023.

Delegation Order – Privacy Act and Privacy Regulations

Civilian Review and Complaints Commission for the RCMP

The Minister of Public Safety Canada, pursuant to section 73 of the Privacy Act*, hereby designates the persons holding the positions set out below, or acting in those positions, to exercise the powers and perform the duties and functions of the Minister as the head of a government institution, that is, the Civilian Review and Complaints Commission for the RCMP, under the provisions of the Act and related regulations set out opposite each position. This designation replaces all previous delegation orders.

Dated, at the City of Ottawa,

this 17 day of November, 2023

Hon. Dominic LeBlanc, P.C., K.C., M.P.

*R.S.C. 1985, c. P-21

Performance in 2024-2025

During the reporting period, thirty-two (32) new requests for personal information under the Act were received. Additionally, nine (9) requests were carried over from the previous year. Of those forty-one (41), thirty-six (36) requests were processed during that period and five (5) were carried forward into 2025-2026. Twenty-four (24) of the thirty-six (36) requests processed (66.7%) were responded to within the established timelines. The total number of pages processed was 20,494 pages, more than double the number of pages of the previous reporting period (9,108).

Carried-Over Requests

During the 2024-2025 reporting period, the CRCC had nine (9) active requests from the 2023‑2024 reporting period. Of these requests, four (4) were closed within legislated timelines and five (5) were closed beyond legislated timelines by the end of the 2024-2025 reporting period. The late responses were due in part to the very large page and audio video file volumes that comprised the responsive records for those requests. As of March 31, 2025, only five (5) of the requests received during 2024-2025 remain open; three (3) requests are within legislative timelines and two (2) requests are beyond legislative timelines. There were no requests from earlier reporting periods carried over to the 2025-2026 reporting period.  

Categories of Information Requested

Twenty-two (22) of the requests for personal information that were processed during 2024‑2025 were from individuals seeking their personal information from public complaints files held by the CRCC, in many cases, for more than one complaint file per request. Six (6) requests were related to human resources topics, and three (3) were general requests from individuals searching for their personal information from the CRCC. Note that the CRCC also received twelve (12) requests from individuals who erroneously applied to the CRCC to obtain law enforcement information from the RCMP. These twelve (12) requests were not counted in this report as official Privacy Act requests received during the reporting period.

Disposition of Requests

Of the thirty-six (36) requests processed during the reporting period, two (2) (6%) were released without redaction; twenty-six (26) (72%) were released in part with exemptions; and one (1) (3%) was abandoned. In the other seven (7) (19%) requests, no records were found to exist.

Response Time

Of the thirty-six (36) closed requests,the CRCC responded to one (1) request that was disclosed in full within 16 to 30 days and another one (1) that was disclosed in full within 61 to 120 days. For requests disclosed in part, the CRCC took 16 to 30 days to respond to two (2) requests; 31 to 60 days to respond to thirteen (13) requests; 61 to 120 days to respond to three (3) requests; 121 to 180 days to respond to two (2) requests; and 181 to 365 days to respond to six (6) requests. One (1) request was abandoned within 15 days, and for requests to which the CRCC responded that no records existed, two (2) requests were responded to within 15 days and five (5) requests were responded to within 16 to 30 days.

Extensions

The CRCC took extensions for twenty-three (23) of the requests, where twelve (12) were taken for external consultations, and eleven (11) were taken for a large volume of active requests and meeting the 30-day deadline would unreasonably interfere with the CRCC's operations.

Exemptions

During the reporting period, the CRCC claimed exemptions pursuant to paragraph 19(1)(a) (information that was obtained in confidence from the government of a foreign state or an institution thereof); paragraph 19(1)(c) (information that was obtained in confidence from the government of a province or an institution thereof); paragraph 19(1)(d) (information that was obtained in confidence from a municipal or regional government established by or pursuant to an Act of the legislature of a province or an institution thereof); subparagraph 22(1)(a)(i) (information that was obtained or prepared by any government institution, or part of any government institution, that is an investigative body specified in the regulations in the course of lawful investigations pertaining to the detection, prevention or suppression of crime); paragraph 22(1)(b) (information the disclosure of which could be injurious to lawful investigations); section 25 (safety of individuals); section 26 (personal information about another individual); and section 27 (solicitor-client privilege) of the Privacy Act.

Consultations

Fifteen (15) consultations were received from other Government of Canada institutions during the reporting period. These consultations all related to documents having to do with public complaints against RCMP members. Fourteen (14) consultations were closed within 30 days, and one (1) was closed within 31 to 60 days, resulting in 208 pages processed.

Complaints

During the 2024-2025 reporting period, the CRCC received four (4) new complaints. Two (2) of the complaints alleged that the CRCC was delayed in providing a response to the requests, and two (2) complaints alleged that the CRCC improperly applied exemptions or withheld records.

During the reporting period, one of the exemption complaints was investigated. The CRCC provided representations and after a short period, the Office of the Privacy Commissioner (OPC) advised that the investigation was closed under its Early Resolution process, and no additional actions were needed by the CRCC. The other three (3) complaints remained active as of March 31, 2025.

As well, one (1) extension complaint was carried over from the 2023-2024 reporting period and remained active as of March 31, 2025.

There were no audits or other investigations conducted during the reporting period.

Summary of Key Issues and Actions Taken on Complaints

During the 2024-2025 reporting period, the CRCC ATIP staff did not take any new actions in response to complaints

Training and Awareness

During the reporting period, all CRCC employees completed mandatory access to information and privacy training through the Canadian School of Public Service. In addition to this, guidance on privacy matters was provided on an ad hoc basis (e.g. in person, by email and through the CRCC's electronic newsletter).

Policies, Guidelines and Procedures

During the reporting period, no new policies, guidelines and procedures were implemented.

Initiatives and Projects to Improve Privacy

During 2024-2025, no new initiatives or projects were undertaken.

Monitoring Compliance

The CRCC monitors the time to process Privacy requests through its case management software. The ATIP Coordinator keeps track of upcoming deadlines for requests and consultations. Reminders of approaching deadlines are provided to senior management at least quarterly. The ATIP Coordinator meets regularly with the CRCC Chairperson and General Counsel to discuss various issues pertaining to in-progress ATIP files.

In compliance with the Directive on Personal Information Requests and Correction of Personal Information,the CRCC uses discretion to limit inter-departmental consultations to requests only where there is the intention to disclose potentially sensitive policing information from external institutions. The CRCC does not consult external institutions before disclosing information that is routinely released to complainants during the public complaint process. This practice is monitored by advising the ATIP Coordinator, General Counsel, and the delegated head of ATIP within the initial 30-day period for each new request, as to whether or not an extension will be taken.

Privacy Impact Assessments

No new privacy impact assessments were completed by the CRCC during the reporting period.

Material Privacy Breaches

During the 2023-2024 reporting period, the CRCC reported one (1) material privacy breach to the Treasury Board of Canada Secretariat (TBS) and the OPC.

The breach was a government-wide incident involving suspicious and unauthorized activity identified on third-party systems belonging to Sirva Worldwide systems (Brookfield Global Relocation Services [BGRS] and Sirva Canada), which occurred from August 17 to September 28, 2023. The OPC responded late in 2024 that they were closing their file on the CRCC's breach report and that the OPC's investigation into the government-wide breach was ongoing.

The CRCC reported no material privacy breaches to the OPC and the TBS (Privacy and Data Protection Division) during the 2024-2025 reporting period.

Public Interest Disclosures

During the 2024-2025 reporting period, the CRCC disclosed a small number of unredacted Chairperson's reports on public complaints involving policies and police training on the performance of welfare checks across Canada to another federal oversight institution. The other institution requested the information for the purpose obtaining research information to support a similar investigation. This information was disclosed pursuant to paragraph 8(2)(j) of the Act. The other institution provided a written undertaking promising not to subsequently disclose the information in an identifiable form.