2024-2025 Annual Report to Parliament: Privacy Act

Indigenous Services Canada's Mandate

The primary mandate of ISC is to work collaboratively with partners to improve access to high quality services for First Nations, Inuit and Métis. The Department aims to support and empower Indigenous Peoples to independently deliver services and address the socio-economic conditions in their communities.

ISC has been given the responsibility to identify the best models for delivering improved services to Indigenous Peoples and improve accountability to Indigenous Peoples for the quality of services delivered by the Department.

As Canada moves towards greater Indigenous self-government, ISC will oversee the provision of existing services to Indigenous Peoples, and particularly First Nations under the Indian Act, including the provision of community infrastructure, emergency management, water, education, moneys and trusts, and registration.

The Department works in collaboration with its partners to create systemic change in how the federal government delivers health services to Indigenous Peoples.

Administration of the Privacy Act at Indigenous Services Canada

ISC's Access to Information and Privacy Office (ATIPO) receives requests for records from the Canadian public and processes them on behalf of the Minister and the Department. They perform their duties under the ATIA and the Privacy Act (PA) and through a Ministerial delegation order.

The ATIP Office is situated in the Corporate Secretariate. The Corporate Secretary is a member of the ISC Senior Management Table.

The ATIP Office also coordinates and implements policies, guidelines and procedures to ensure departmental compliance with the ATIA and PA. Workshop presentations, training courses and awareness sessions designed to increase access to information and privacy capacity across the Department are also provided.

Under section 96, CIRNAC provides shared ATIP services to Indigenous Servies Canada (ISC) through Service Level Agreements (SLA). ISC's Corporate Secretary manages the SLA for approval and it is updated yearly

Delegation of ministerial responsibilities for the ATIA and PA remains institutionally specific.

Under a shared service model, all ATIP analysts process requests for both ISC and CIRANC. Requests are varied in volume and complexity and treated separately.

The ATIP Office provides advice and guidance to the Department on a number of topics:

1. The application of the ATIA and PA;
2. The release of sensitive or protected information to the public;
3. Education and awareness of access to information and privacy issues throughout the Department;
4. Proactive publications;
5. Departmental Privacy Impact Assessments (PIAs);
6. Permissible disclosures of personal information pursuant to subsection 8(2) of the PA;
7. Appropriate PA Statements on Data Collection Instruments, i.e. forms, surveys, recorded events, etc.;
8. Updates to Info Source and the preparation and registration of Personal Information Banks and their related Classes of Records;
9. Protocols surrounding privacy breaches; and
10. Privacy advice in Memoranda of Understanding, Information Sharing Agreements and more complicated Multi-Jurisdictional Information Sharing Agreements (MISAs).

The Intake Team triages and coordinates the receipt of requests for records from the Canadian public or persons residing in Canada under the control of the Department and made pursuant to the ATIA and PA.

The Operations Team processes records in line with the ATIA and PA. The Team ensures that responses are provided within the legislated timeframe.

In addition to the ATIP Office, within each of the sectors and regional offices of ISC there are ATIP Liaison Officers (ALOs) who receive callouts from the ATIP Office and subsequently task the requests to areas within their sector to retrieve records. ALOs play a crucial role in ensuring the appropriate records, impact statements and approvals are obtained and communicated to the ATIP Office within the designated time allowances.

ATIP analysts work closely with the relevant program areas in order to ensure that all responsive documents are identified and to ensure that the information contained within those documents are treated in accordance with the Acts. This work ensures departmental records are appropriately disclosed to the Canadian public in support of openness and transparency.

All requests are monitored and processed using the AccessPro case management system. The ATIP Office will be transitioning away from this sunsetting case management system. A new system called ATIPXpress has been procured. This solution was chosen to increase efficiency by reducing processing times and moving away from a more manual system. It will reduce the number of late complaints received due to missing legislative timelines. This new case management system provides a supported, stable, and technologically contemporary tool to manage both Department's workloads fluidly within one system, further cutting processing time. The solution is expected to be implemented in fiscal 2025-2026.

ATIP Operations is working on updating and formalizing their Developmental Program in order to recruit and retain qualified analysts with specialized skills. The multi-phased program is based on performance benchmarks that clearly state the expectations at each level from CR-04 to PM-06. An employee can choose to participate in the program to develop their skills, build experience and advance their careers within the organization. With guidance from the Team Leaders, analysts can gain specialized expertise related to ISC's unique record sets.

This program is developed with the intent to be open and transparent in order to develop and retain current staff and provide growth opportunities within the ATIP Office and the Department. The pilot Developmental Program has been highly successful. This reporting period, eleven analysts were promoted or provided acting opportunities based on their success in the pilot program.

The Department has continued to meet its proactive publication requirements in this reporting period and has published briefing material titles submitted to the Minister and Deputy Minister on a monthly basis as well as the summaries of the completed requests on the Open Government Portal, thereby continuing to improve communication with applicants and promoting transparency.

The Department continued to use the Microsoft Office 365 tools, to communicate internally and engage with key stakeholders. The ATIP office also leveraged these tools for the transfer of information with sectors to allow for business continuity within the hybrid workplace structure.

To better serve our clients, the Department participates in the Access to Information and Privacy Online Request Service. Canadians can submit requests under the Acts through this online channel administered by TBS.

The ATIPO continues to work in a hybrid model. Since pandemic response conditions substantially reduced the use of paper, the office mostly received electronic requests and records. It provided release packages electronically to applicants with the use of E-post Connect, which was implemented in February 2020.

Director's Office

The Director (EX-01), as institutional ATIP Coordinator, holds full delegated authority under the ATIA. The Director is supported in day-to-day administrative tasks by the Deputy Director Operations (PM-06), Deputy Director Privacy/Policy (PM-06), an Administrative Assistant (AS-01) and is also supported in reporting by the Systems Administrator (AS-04).

Privacy/Policy Team

The Privacy/Policy Team is led by two Team Leaders (PM-05), who are responsible for ensuring the department is adhering to the collection, use and disclosure of personal information holdings as per the PA. They also ensure all policies for Access and Privacy align with Treasury Board policies and directives. The Privacy/Policy Team consists of Analysts at the PM-04, PM-03 and PM-02 levels who respond to privacy policy matters (such as privacy breaches, court ordered disclosure requests, Privacy Assessments, etc.) and provide training and Privacy advice. They are supported by an Intake Clerk (CR-04).

Operations Team

The Operations Team is led by three Team Leaders (PM-05), who are responsible for the overview of request processing by their team, including the review of completed requests. The Operations Team consists of Analysts at the PM-04, PM-03, and PM-02 levels who process Access and Privacy requests of varying volume and complexity, as well as provide training.

Intake Team

The Intake Team is led by one Team Lead (PM-5) and is comprised of various Intake Officers (PM-01s and CR-04s), who enter all applications into the electronic case management system, acknowledge receipt of requests, perform imaging services, interact with and respond to inquiries from the public.

1. Requests under the Privacy Act

2. Informal requests

An informal request is defined as a request for copies of previously processed and released privacy requests. No Informal requests were received pursuant to the PA in 2024-2025.

3. Requests closed during the reporting period

3.1 Disposition and completion time

Of the 490 requests closed during the reporting period, ISC was able to fully or partially disclose records in 327 cases (67% of the requests) (Table 3.1.1). The most frequent outcome of requests processed during the reporting period was a partial disclosure, in 186 cases or 38% of the time. Records were disclosed in their entirety 29% of the time and no records existed in 87 cases or 18% of requests. (Table 3.1.1).

Text alternative for Table 3.1.1 Disposition of completed requests

Dispositions	Percentage of requests
All disclosed	38%
Disclosed in part	29%
No records exist	18%
Request abandoned	15%

During the course of the current reporting period, 128 requests were processed and completed within the initial 15 days of receipt and another 241 were closed between 16 and 30 days resulting in 75% of closed requests completed within 30-days. An additional 77 files were completed between 31 and 60 days of receipt, with or without an extension recorded on the file. The remaining 44 files were finalized in 61 or more days.

Table 3.1.2 Disposition and completion time

Disposition of requests	Completion Time (days)
	1 to 15	16 to 30	31 to 60	61 to 120	121 to 180	181 to 365	> 365	Total
All disclosed	12	155	12	7	0	0	0	186
Disclosed in part	0	45	60	23	5	7	1	141
All exempted	0	1	0	0	0	0	0	1
All excluded	0	0	0	0	0	0	0	0
No records exist	46	36	4	1	0	0	0	87
Request abandoned	270	4	1	0	0	0	0	75
Neither confirmed nor denied	0	0	0	0	0	0	0	0
Total	128	241	77	31	5	7	1	490

4. Disclosure under subsections 8(2) and 8(5)

Permissible disclosure pursuant to subsection 8(2) of the PA describes the circumstances under which personal information under the control of government institutions may be disclosed without the consent of the individual to whom the information pertains. In 2024-2025, ISC made 42 permissible disclosures under 8(2)(e). The Treasury Board of Canada Secretariat requires these permissible disclosures to be captured in the statistical report.

The disclosures authorized under 8(2)(e) pursuant to requests made by investigative bodies were completed in accordance with the PA. The PA permits the disclosure of personal information to an investigative body specified in the regulations, on the written request of the body, for the purpose of enforcing any law of Canada or a province or carrying out a lawful investigation, if the request specifies the purpose and describes the information to be disclosed. The Department has the control of a substantial amount of personal information required to provide benefits and services to Indigenous Peoples.

There were no disclosures authorized under 8(2)(m). The PA permits disclosure under 8(2)(m) pursuant to any purpose where, in the opinion of the head of the institution the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or disclosure would clearly benefit the individual to whom the information relates.

The Office of the Privacy Commissioner must be notified of disclosures pursuant to section 8(2)(m); as required under section 8(5) of the PA. This was completed once as required in 2024-2025.

Other permissible disclosures not captured by the statistical report include:

There were 16 disclosures authorized under 8(2)(d) pursuant to a request from the Department of Justice and disclosure complied existing criteria for disclosure. The PA permits the disclosure of personal information to the to the Attorney General of Canada for use in legal proceedings involving the Crown in right of Canada or the Government of Canada.

There were 1141 disclosures authorized under 8(2)(f) pursuant to an agreement or arrangement between the Government of Canada and another jurisdiction for the purpose of administering or enforcing any law or carrying out a lawful investigation. The department provides services across multiple-jurisdictions and agreements exist and continue to be drafted to respect the department's obligations under the PA.

There were 6 disclosures authorized under 8(2)(j) pursuant to requests to undertake research or statistical activities. The PA permits the disclosure personal information to any person or body for research or statistical purposes with specific provisions.

There were 184 disclosures authorized under 8(2)(k) pursuant to requests from the authorized researchers identified in the PA. The PA permits the disclosure of personal information for the purpose of researching or validating the claims, disputes or grievances of any of the Indigenous Peoples of Canada.

The ATIP Office authorized a combined total of 1432 disclosures pursuant to section 8(2) of the PA during 2024-2025.

5. Requests for Correction of Personal Information and Notations

During the reporting period, there were no requests for correction of personal information or notations.

6. Extensions

7. Consultations received from Other Institutions and Organizations

ISC did not receive any consultations from another Government of Canada institutions or other organizations during 2024-2025.

8. Completion Time of Consultations on Cabinet confidences

During the reporting period, no consultations on the application of section 70 of the PA were sent to Departmental Legal Services Unit for consultation on potential Cabinet confidences.

9. Complaints and Investigations Notices Received

During the 2024-2025 reporting period, there were 16 complaints received from the Office of the Privacy Commissioner (section 31). There were 9 complaints closed, resulting in the Department processing an additional 11,609 pages. The Treasury Board of Canada requires institutions to track sections 31, 33 and 35 of the Privacy Act in the statistical report (Table 9).

10. Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

11. Privacy Breaches

12. Resources related to the Privacy Act

V. Monitoring Compliance

The ATIP Office does weekly, monthly, quarterly and ad hoc reporting on all aspects of ATIP Operations and compliance with all levels of staff. During the reporting period there were weekly meetings with Minister's Office, Deputy Minister's Office, Parliamentary Affairs and Communications in order to present the incoming and outgoing requests. Monthly statistical reporting of ATIP Operations is completed and presented to the Corporate Secretary, as well as quarterly reporting on compliance for sectors. The Director of ATIP meets on an ad hoc basis to discuss non-compliance with the sector heads. The System Administrator is responsible for all reporting functions including the time taken to process privacy requests and Operations Unit compliance.

The Privacy Policy Unit provides guidance and advice to sectors when requested in relation to the collection, use and disclosure of personal information associated to contracts, agreements and arrangements. The Privacy Policy Unit has tools and guidance available for the sharing of personal information under section 8(2) of the Privacy Act. Additionally, the Privacy Policy Unit provides input into program authority development to ensure privacy is considered and planned at the beginning of activities.

Delegation Order

Sections and Powers, Duties or Functions

8(2)

Disclose personal information without the consent of the individual to whom it relates

8(4)

Keep copies of requests made under 8(2)(e), keep records of information disclosed pursuant to such requests and to make those records available to Privacy Commissioner

8(5)

Notify the Privacy Commissioner in writing of disclosure under paragraph 8(2)(m)

9(1)

Retain a record of use of personal information

9(4)

Notify the Privacy Commissioner of consistent use of personal information and update index accordingly

10

Include personal information in personal information banks

11(a)

Publish annually an index of all personal information banks and their respective contents

11(b)

Publish annually an index of all personal information held by the institution which is not part of a bank

14

Respond to request for access, within statutory deadline; give access or give notice

15

Extend time limit and notify applicant

16

Where access is refused

17(2)(b)

Language of access or alternative format of access

17(3)(b)

Access to personal information in alternative format

18(2)

May refuse to disclose information contained in an exempt bank

19(1)

Shall refuse to disclose information obtained in confidence from another government

19(2)

May disclose any information referred to in 19(1) if the other government consents to the disclosure or makes the information pubic

20

May refuse to disclose information injurious to federal-provincial affairs

21

May refuse to disclose information injurious to international affairs and/or defence

22

May refuse to disclose information injurious to law enforcement and investigation

23

May refuse to disclose information injurious to security clearances

24

May refuse to disclose information collected by the Canadian Penitentiary Service, the National Parole Service or the National Parole Board

25

May refuse to disclose information injurious to which could threaten the safety of individuals

26

May refuse to disclose information about other individuals, and shall refuse to disclose such information where disclosure is prohibited under section 8

27

May refuse to disclose information subject to solicitor-client privilege

28

May refuse to disclose information relating to an individual's physical or mental health where disclosure is contrary to the best interests of the individual

31

Receive notice of investigation by the Privacy Commissioner

33(2)

Make representations to the Privacy Commissioner during an investigation

35(1)

Receive the Privacy Commissioner's report of findings of the investigation and give notice of action taken

35(4)

Give complainant access to information after 35(1)(b) notice

36(3)

Receive Privacy Commissioner's report of findings of investigation of exempt

37(3)

Receive report of Privacy Commissioner's findings after compliance investigation where the institution has not complied with sections 4 to 8

51(2)(b)

Request that matter be heard and determined in National Capital Region

51(3)

Request and be given right to make representations in section 51 hearing

72(1)

Prepare Annual Report to Parliament

77

Carry out responsibilities conferred on the Head of the institution by the regulations made under section 77 which are not included above

1.1.1 Number of requests received

1.1.2 Number of requests received

1.2 Channels of requests

2.1.1 Number of informal requests

2.1.2 Number of informal requests

2.2 Channels of informal requests

2.3 Completion time of informal requests

2.4 Pages released informally

3.1 Disposition and completion time

3.2 Exemptions

3.3 Exclusions

3.4 Format of information released

3.5 Complexity

3.6 Closed requests

3.7 Deemed refusals

3.8 Requests for translation

4.1 Disclosures under subsections 8(2) and 8(5)

5.1 Requests for correction of personal information and notations

6.1 Reasons for extensions

6.2 Length of extensions

7.1.1 Consultations received from other Government of Canada institutions and other organizations

7.1.2 Consultations received from other Government of Canada institutions and other organizations

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada

8.1 Requests with Legal Services

8.2 Requests with Privy Council Office

9.1 Complaints and investigations notices received

10.1 Privacy Impact Assessments

10.2 Institution-specific and Central Personal Information Banks

11.1 Material Privacy Breaches reported

11.2 Non-Material Privacy Breaches

12.1 Allocated Costs

12.2 Human Resources