Annual Report to Parliament on the Administration of the Privacy Act 2021-2022

Introduction

The Privacy Act (Act) provides individuals with a right of access to their personal information and protects the privacy of individuals with respect to personal information under the control of government institutions.

This Annual Report was prepared in accordance with section 72 of the Act, which stipulates that annual reports on privacy shall be tabled in Parliament.

About the Civilian Review and Complaints Commission for the Royal Canadian Mounted Police

The Civilian Review and Complaints Commission for the Royal Canadian Mounted Police (CRCC) operates pursuant to the Royal Canadian Mounted Police Act, R.S.C. 1985, c. R‑10. The CRCC provides civilian review of RCMP members' conduct in performing their policing duties so as to hold the RCMP accountable to the public.

One of the CRCC's main roles is to take public complaints about members of the RCMP. These complaints are then forwarded to the RCMP for initial investigation as mandated by the Royal Canadian Mounted Police Act; however, if the complainant is dissatisfied with the response that he or she receives from the RCMP, the CRCC will review the complaint with a view to determining the reasonableness of the RCMP's response. In appropriate cases, the CRCC will undertake its own investigation or hearing into a complaint. The Chairperson of the CRCC also has the power to file his or her own complaint if he or she feels that a matter is deserving of investigation.

Additionally, even in the absence of a public complaint, the CRCC is empowered to conduct a review of RCMP activities to evaluate compliance with legislation, regulations, ministerial directions, policy, procedures and/or guidelines.

ATIP Responsibilities

At the CRCC, the Access to Information and Privacy (ATIP) Unit consists solely of the ATIP Coordinator. The ATIP Coordinator processes all requests from the public and consultations from other departments or agencies. The ATIP Coordinator also provides advice to CRCC employees and senior officials on ATIP-related matters, prepares annual ATIP reports, ensures the ongoing accuracy of Info Source, prepares completed Access to Information summaries for proactive disclosure on the CRCC's website, participates in forums for the ATIP community and monitors changes in ATIP policy, guidelines and directives.

When processing requests and consultations under the Access to Information and Privacy Acts, the ATIP Coordinator also benefits from some administrative assistance from personnel in the Information Management Unit of the CRCC and a student assistant.

The CRCC Chairperson, under delegated authority from the Minister of Public Safety, provides the final approval for all responses on ATIP requests and consultations.

During the reporting period, the CRCC was not party to any service agreements under section 73.1 of the Privacy Act.

Delegation Order

The Minister of Public Safety has delegated full authority under the Act to the CRCC Chairperson and Senior Director, Operations. The Minister has also delegated administrative duties and functions to the CRCC ATIP Coordinator. The most recent delegation order was signed by the Minister of Public Safety on July 4, 2016 (see Annex A).

Privacy Requests Received

During the course of the reporting period, seventy-five (75) new requests for personal information under the Act were received. Four (4) requests were carried over from the previous year. Of those seventy-nine (79), sixty-eight (68) requests were processed during that period and eleven (11) were carried forward into 2022-2023.

Twenty-seven (27) of the requests for personal information that were processed during 2021-2022 were from individuals or their representatives seeking their personal information from public complaints files held by the CRCC. Thirty-seven (37) were from individuals who erroneously applied to the CRCC to obtain law enforcement information from the RCMP and four (4) were general requests searching for their personal information from the CRCC.

The total number of pages processed during the reporting period was 4,699.

Performance

During the reporting period, sixty (60) of the sixty-eight (68) requests processed (88.2%) were responded to within the established timelines.

The seventy-five (75) Privacy requests received by the CRCC in 2021-2022 represent a dramatic increase over the number of Privacy requests received in recent years:

2021-22    75
2020-21    46
2019-20    32
2018-19    27
2017-18    11
2016-17      9

The increase in number of requests received in recent years is likely attributable to the ATIP Online Request Service, which has allowed requesters to submit their requests online to the CRCC since late 2018, many of which it turned out were intended for other institutions.

During the 2021-2022 reporting period, the CRCC had one (1) active request from the 2019-2020 reporting period, and three (3) active requests from the 2020-2021 reporting period. The request from 2019-2020 was closed beyond legislated timelines during the 2021-2022 reporting period. For the 2020-2021 requests, all three (3) were closed within legislated timelines during the 2021-2022 reporting period.

Of the sixty-eight (68) requests processed during the reporting period, five (5) (7.3%) were released without redaction, and eighteen (18) (26.5%) were released in part with exemptions. In the other forty-five (45) requests, no records were found to exist.

During the reporting period, the CRCC claimed exemptions pursuant to subparagraph 22(1)(a)(i) (that was obtained or prepared by any government institution, or part of any government institution, that is an investigative body specified in the regulations in the course of lawful investigations pertaining to the detection, prevention or suppression of crime), paragraph 22(1)(b) (Information the disclosure of which could be injurious to lawful investigations), section 25 (Safety of individuals), section 26 (Personal information about another individual), and section 27 (Solicitor-client privilege) of the Privacy Act.

External consultation was required for thirteen (13) requests.

The statutory deadlines were not met for six (6) requests due to external consultation, and one (1) request due to interference with operations or workload.

Eleven (11) consultations were received from other Government of Canada institutions during the reporting period. These consultations all related to documents having to do with public complaints against RCMP members. All eleven (11) consultations were closed during the reporting period, resulting in 207 pages processed.

See Annex B for the Statistical Report.

On March 14, 2020, the CRCC implemented exceptional workplace measures to curb the spread of novel coronavirus (COVID-19) and protect federal employees and the public.

Since that date, the CRCC Access to Information and Privacy staff has been working from home most of the time, but completes tasks that cannot be performed remotely by attending the CRCC workplace as required. This work is supported by part-time on-site information management staff. However, unlike many federal institutions, these measures have not negatively impacted the CRCC's performance.

Training and Awareness

During the reporting period, no CRCC employees participated in formal privacy training. However, guidance on privacy matters was provided on an ad hoc basis (e.g. in person, by email and through the CRCC's electronic newsletter).

Policies, Guidelines, Procedures and Initiatives

The ATIP Unit has been actively involved in communicating evolving privacy requirements emerging in the context of the COVID-19 pandemic to protect the personal information of the CRCC's employees and members of the public that the CRCC serves. These communications include Treasury Board of Canada Secretariat policies and directives on privacy, as well as general advice on email encryption and personal information handling for employees working at home.

Furthermore, due to exceptional workplace measures implemented to curb the spread of novel coronavirus (COVID-19), the ATIP Office developed new secure online procedures for the review and approval process for completed requests. With the support of the Information Technology staff, the ATIP Office has also implemented new procedures for offices of primary interest to provide large volumes of records to the ATIP Unit quickly and securely while working at home.

Monitoring of Timeliness

The CRCC monitors the time to process Privacy requests through its case management software. The ATIP Coordinator keeps track of upcoming deadlines for requests and consultations. Reminders of approaching deadlines are provided to senior management at least quarterly. The ATIP Coordinator meets regularly with the CRCC Chairperson and General Counsel to discuss various issues pertaining to in-progress ATIP files.

Privacy Impact Assessments

The CRCC completed one privacy impact assessment (PIA) which the CRCC submitted to Treasury Board and the Office of the Privacy Commissioner. As a result of the PIA, the CRCC also submitted an amended institution-specific personal information bank (PIB) to the Treasury Board of Canada Secretariat for registration.

Privacy Breaches

There were no material privacy breaches at the CRCC during the reporting period.

Disclosures Made Pursuant to Paragraph 8(2)(m) of the Privacy Act

The CRCC made no disclosures of personal information pursuant to paragraph 8(2)(m) of the Act in 2021-2022.

Complaints

During the 2021-2022 reporting period, one (1) new complaint was filed against the CRCC alleging that the CRCC refused to release records. This complaint had not yet been investigated as of March 31, 2022.

During the 2020-2021 reporting period, the CRCC received a complaint that alleged that the CRCC shared personal information improperly with another federal institution. After an investigation, the Office of the Privacy Commissioner issued a finding during the 2021-2022 reporting period that the complaint was not well-founded.

The CRCC had no other active complaints during the 2021-2022 reporting period that were opened during a previous reporting period.

There were no audits or other investigations conducted during the reporting period.

Summary of Key Issues and Actions Taken on Complaints

CRCC ATIP staff has adopted more rigorous procedures for retrieving records from Offices of Primary Interest after examining its practices during complaint investigations during the 2021-2022 reporting period.

Appendix A: Delegation Order

The Minister of Public Safety Canada, pursuant to section 73 of the Privacy Act*, hereby designates the persons holding the positions set out below, or acting in those positions, to exercise the powers and perform the duties and functions of the Minister as the head of a government institution, that is, the Civilian Review and Complaints Commission for the RCMP, under the section of the Act set out opposite each position.

Dated, at the City of Ottawa, 4th of July 2016.

Signed by the Honourable Ralph Goodale, P.C., M.P., Minister of Public Safety Canada

*R.S.C. 1985, c. P-21

Appendix B: Statistical Report

Reporting period: 2021-04-01 to 2022-03-31

Supplemental Statistical Report on the Access to Information Act and Privacy Act

Reporting period: 2021-04-01 to 2022-03-31

Section 1: Capacity to Receive Requests under the Access to Information Act and the Privacy Act

Section 2: Capacity to Process Records under the Access to Information Act and the Privacy Act

Section 3: Open Requests and Complaints Under the Access to Information Act

3.1 Enter the number of open requests that are outstanding from previous reporting periods.

3.2 Enter the number of open complaints with the Information Commissioner of Canada that are outstanding from previous reporting periods.