Annual Report on the Access to Information Act and the Privacy Act—2014–15

Annual Report on the Access to Information Act and the Privacy Act—2014–15

Annual Report on the Access to Information Act—2014–15

Introduction

When the Federal Accountability Act was enacted in 2006, amendments were made to the Access to Information Act and the Privacy Act, both of which came into force in 1983. The scope of application of these laws was expanded, and the Office of the Auditor General of Canada (OAG) became subject to the Access to Information Act.

The Access to Information Act gives Canadian citizens and permanent residents, and any person and corporation present in Canada, the right to access information contained in government records, subject to certain specific and limited exceptions.

Section 72 of the Act requires the head of each government institution to prepare an annual report on the administration of the Act within the institution and to submit the report to Parliament.

This annual report on the administration of the Access to Information Act at the OAG describes how we administered our responsibilities under the Act during the 2014–15 fiscal year.

If you require more information or wish to make a request under the Access to Information Act or the Privacy Act, please direct your inquiries to the following:

Who we are

The Office of the Auditor General of Canada (OAG) audits federal government operations and provides Parliament with independent information, advice, and assurance regarding the federal government’s stewardship of public funds. While the OAG may comment on policy implementation in an audit, it does not comment on policy itself.

We are in the business of legislative auditing. We conduct

• performance audits of federal departments and agencies;
• annual financial audits of the government’s financial statements;
• special examinations and annual financial audits of Crown corporations; and
• audits of the governments of Nunavut, Yukon, and the Northwest Territories.

Since 1995, the OAG has also had a specific environmental and sustainable development mandate, which was established through amendments to the Auditor General Act.

The Auditor General of Canada is the designated head of the institution for the Access to Information Act as well as the Privacy Act. Pursuant to section 73 of both acts, the Auditor General has delegated full authority to the Access to Information and Privacy Coordinator.

Access to Information and Privacy Office

The Access to Information and Privacy (ATIP) Coordinator is accountable for the development and implementation of effective policies, guidelines, systems, and procedures to ensure that the Office of the Auditor General of Canada (OAG) meets its responsibilities under the Access to Information Act and the Privacy Act.

The ATIP Office at the OAG comprises

• one full-time ATIP Coordinator;
• two full-time employees from other groups at the OAG, who help the ATIP Office on a part-time, ad hoc basis; and
• one full-time legal counsel, who helps the ATIP Office on a part-time, ad hoc basis.

The main activities of the ATIP Coordinator include

• monitoring compliance with the acts, regulations, and relevant procedures and policies;
• processing requests under both acts;
• developing and maintaining policies, procedures, and guidelines to ensure that the OAG respects the acts;
• promoting awareness of the acts within the OAG to ensure that employees are aware of their responsibilities;
• preparing annual reports to Parliament and other statutory reports, as well as other material that may be required by central agencies;
• representing the OAG in dealings with the Treasury Board of Canada Secretariat, the information and privacy commissioners, and other government departments and agencies to determine how the acts apply to the OAG; and
• helping the OAG meet its commitments to ensure openness and transparency, through proactive and informal disclosure of information.

Highlights and accomplishments for the 2014–15 fiscal year

One hundred percent compliance

No formal Access to Information Act or Privacy Act requests have passed their legislative deadline during the 2014–15 fiscal year. The Office of the Auditor General of Canada (OAG) is proud to have achieved 100 percent compliance with deadlines under both acts.

Training and awareness

All new employees of the OAG receive Access to Information and Privacy (ATIP) training during mandatory orientation days. In addition, awareness sessions and unit-specific training sessions include ATIP components. During the 2014–15 fiscal year, 160 employees received ATIP training during six sessions on awareness of security, ATIP, information management and information technology, and during two orientation sessions for new employees.

Administration of the Access to Information Act

Requests under the Access to Information Act

Sources of requests received

The sources of requests varied more in the 2014–15 fiscal year than in previous fiscal years. An equal number of requests were received from private sector businesses (3) and the general public (3). In addition, requests were received from the media (2) and an organization (1).

Disposition of completed requests

The Office of the Auditor General of Canada (OAG) finalized 12 requests in the 2014–15 fiscal year:

• 2 requests were disclosed in their entirety,
• 5 requests resulted in partial disclosure,
• 2 requests resulted in total exemption of all records,
• 2 requests could not be processed because no relevant records existed, and
• 1 request was abandoned by the requester.

Exemptions invoked

Appendix A indicates the number of requests where specific types of exemptions were invoked. For example, if the OAG applied five different exemptions in processing a request, one exemption under each relevant section is reported—for a total of five. If the same exemption was claimed several times for the same request, it is reported only once.

As noted, the OAG invoked exemptions under sections 16.1(1)(a), 19(1), 20(1)(b), 21(1)(a), 21(1)(b), 22, and 23 of the Access to Information Act.

Exclusions cited

The OAG did not invoke any exclusions pursuant to the Access to Information Act for the 2014–15 fiscal year.

Extension of time limits

Section 9 of the Act provides for the extension of the statutory time limits if consultations are necessary, or if a large number of records have been requested and processing the request within the original time limit would unreasonably interfere with OAG operations. During the reporting period, three requests were extended for 30 days or less pursuant to section 9(1)(a), one request was extended for 30 days or less pursuant to section 9(1)(b), and one request was extended for more than 30 days pursuant to section 9(1)(c).

Completion time

Of the 12 requests completed during the reporting period,

• 6 were completed by the original 30-day deadline,
• 4 required up to an additional 30 days, and
• 1 required between 61 and 180 days.

Method of access

Where the relevant documents were given either in part or in their entirety, paper copies of documents were provided for three requests, and electronic copies were provided for four requests.

Fees

The fees collected during the reporting period totalled $55. In accordance with government policy, the OAG’s practice is to waive photocopy or search fees when the total per request is less than $25. In the 2014–15 fiscal year, the $5 application fee was waived in one instance due to exceptional circumstances.

Costs

The costs directly associated with administration of the Access to Information Act for the 2014–15 fiscal year are estimated to be $114,928 for salaries and $1,210 for goods and services, for a total of $116,138.

Complaints and investigations

The OAG received no new complaints in the 2014–15 fiscal year. One outstanding complaint received during the 2011–12 fiscal year was closed by the Office of the Information Commissioner on 10 March 2015 as “settled” with no further action required.

The complainant in this case was seeking information previously redacted pursuant to sections 20(1)(b), (c), and (d) of the Act on three pages of documentation. This information was originally exempted, as required by the Act, after consultation with the third party to whom the information related. In July 2014, the OAG’s Access to Information and Privacy (ATIP) Coordinator called the complainant directly to attempt to expedite the closure of the complaint. After ascertaining what the complainant sought to obtain, the ATIP Coordinator entered into new consultation with the third party. The third party agreed that disclosure of the information was no longer a concern. In November 2014, the ATIP Coordinator agreed to disclose certain portions of the previously exempted information. This fact was communicated to the Office of the Information Commissioner, which deemed the complaint “settled.”

The OAG has not received any complaints since the 2011–12 fiscal year.

Institution-specific policies, guidelines, and procedures

The OAG did not revise policies, guidelines, or procedures—or implement new ones—during the 2014–15 fiscal year.

Monitoring

The OAG uses time-code (product-code) management software, essentially a digital “timesheet,” to track all audit and audit-service activities, including

• management of the ATIP Office,
• management of Access to Information cases (treatment of formal Access to Information Act requests and consultations),
• management of privacy cases (treatment of formal and informal Privacy Act requests), and
• privacy impact assessments.

Whenever employees or contractors of the OAG participate in any ATIP-related activity, they must track the time they spend on the activity by entering the number of hours or partial hours into the product-code management software. These records are monitored on a regular basis for human resource and financial purposes. Any employee with access to the OAG network can use the OAG’s INTRAnet (internal Internet) to view this data.

As reflected in part 9.2 of Appendix A, the OAG dedicated 1.25 person-years to ATIP-related activities.

Appendix A: Report on the Access to Information Act

Name of institution: Office of the Auditor General of Canada

Reporting period: 2014-04-01 to 2015-03-31

Part 1: Requests Under the Access to Information Act

1.1 Number of Requests

1.2 Sources of requests

1.3 Information requests

Note: All requests previously recorded as “treated informally” will now be accounted for in this section only.

Part 2: Requests Closed During the Reporting Period

2.1 Disposition and completion time

2.2 Exemptions

2.3 Exclusions

2.4 Format of information released

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

2.5.2 Relevant pages processed and disclosed by size of requests

2.5.3 Other Complexities

2.6 Deemed refusals

2.6.1 Reasons for not meeting statutory deadline

2.6.2 Number of days past deadline

2.7 Requests for translation

Part 3: Extensions

3.1 Reasons for extensions and disposition of requests

3.2 Length of extensions

Part 4: Fees

Part 5: Consultations Received From Other Institutions and Organizations

5.1 Consultations received from other Government of Canada institutions and organizations

5.2 Recommendations and completion time for consultations received from other Government of Canada institutions

5.3 Recommendations and completion time for consultations received from other organizations

Part 6: Completion Time of Consultations on Cabinet Confidences

6.1 Requests with Legal Services

6.2 Requests with Privy Council Office

Part 7: Complaints and Investigations

Part 8: Court Action

Part 9: Resources related to the Access to Information Act

9.1 Costs

9.2 Human Resources

Annual Report on the Privacy Act—2014–15

Introduction

The Privacy Act gives individuals the right to access information about themselves that is held by the Office of the Auditor General of Canada (OAG), subject to certain specific and limited exceptions. The Privacy Act also protects the privacy of individuals by giving them substantial control over the collection, use, and disclosure of their personal information and by preventing others from having access to that information.

Section 72 of the Act requires the head of each government institution to prepare an annual report on the administration of the Act within the institution and to submit the report to Parliament.

This annual report on the administration of the Privacy Act at the OAG describes how we administered our responsibilities under the Act during the 2014–15 fiscal year.

If you require more information or wish to make a request under the Access to Information Act or the Privacy Act, please direct your inquiries to the following:

Who we are

The Office of the Auditor General of Canada (OAG) audits federal government operations and provides Parliament with independent information, advice, and assurance regarding the federal government’s stewardship of public funds. While the OAG may comment on policy implementation in an audit, it does not comment on policy itself.

We are in the business of legislative auditing. We conduct

• performance audits of federal departments and agencies;
• annual financial audits of the government’s financial statements;
• special examinations and annual financial audits of Crown corporations; and
• audits of the governments of Nunavut, Yukon, and the Northwest Territories.

Since 1995, the OAG has also had a specific environmental and sustainable development mandate, which was established through amendments to the Auditor General Act.

The Auditor General of Canada is the designated head of the institution for the Access to Information Act as well as the Privacy Act. Pursuant to section 73 of both acts, the Auditor General has delegated full authority to the Access to Information and Privacy Coordinator.

Access to Information and Privacy Office

The Access to Information and Privacy (ATIP) Coordinator is accountable for the development and implementation of effective policies, guidelines, systems, and procedures to ensure that the Office of the Auditor General of Canada (OAG) meets its responsibilities under the Access to Information Act and the Privacy Act.

The ATIP Office at the OAG comprises

• one full-time ATIP Coordinator;
• two full-time employees from other groups at the OAG, who help the ATIP Office on a part-time, ad-hoc basis; and
• one full-time legal counsel, who helps the ATIP Office on a part-time, ad hoc basis.

The main activities of the ATIP Coordinator include

• monitoring compliance with the acts, regulations, and relevant procedures and policies;
• processing requests under both acts;
• developing and maintaining policies, procedures, and guidelines to ensure that the OAG respects the acts;
• promoting awareness of the acts within the OAG to ensure that employees are aware of their responsibilities;
• preparing annual reports to Parliament and other statutory reports, as well as other material that may be required by central agencies;
• representing the OAG in dealings with the Treasury Board of Canada Secretariat, the information and privacy commissioners, and other government departments and agencies to determine how the acts apply to the OAG; and
• helping the OAG meet its commitments to ensure openness and transparency, through proactive and informal disclosure of information.

Administration of the Privacy Act

Requests under the Privacy Act

Disposition of completed requests

The OAG finalized two requests in the 2014–15 fiscal year. Neither request yielded any records.

Exemptions invoked

Appendix B indicates the number of requests where specific types of exemptions were invoked. For example, if the OAG applied five different exemptions in processing a request, one exemption under each relevant section is reported—for a total of five. If the same exemption was claimed several times for the same request, it is reported only once.

As noted, the OAG did not invoke any exemptions for the 2014–15 fiscal year.

Exclusions cited

The OAG did not invoke any exclusions pursuant to the Privacy Act for the 2014–15 fiscal year.

Completion time

Of the two requests completed during the reporting period,

• one was completed by the original 30-day deadline, and
• one required an additional 15 days to complete due to interference with operations, pursuant to section 15(a)(i).

Extension of time limits

During the 2014–15 fiscal year, one request was extended for 15 days due to interference with operations, pursuant to section 15(a)(i).

Method of access

As neither request yielded any records, no records were disclosed to either requester.

Costs

The costs directly associated with administration of the Privacy Act for the 2014–15 fiscal year are estimated to be $13,789 for salaries. No costs were incurred for goods and services, contracts, or other expenses.

Complaints and investigations

The OAG did not receive any complaints pursuant to the Privacy Act during this reporting period, and no investigations regarding the OAG were carried out.

Disclosure of personal information under section 8(2)

On one occasion during the reporting period, the OAG disclosed personal information pursuant to section 8(2)(m)(ii) of the Privacy Act so that former employees could receive pay equity settlement payments from the Canada Revenue Agency. The Privacy Commissioner of Canada was notified of this disclosure at the same time the information was provided to the Canada Revenue Agency.

Institution-specific policies, guidelines, and procedures

The OAG did not revise policies, guidelines, or procedures—or implement new ones—during the 2014–15 fiscal year.

Monitoring

The OAG uses time-code (product-code) management software, essentially a digital “timesheet,” to track all audit and audit-service activities, including

• management of the ATIP Office,
• management of Access to Information cases (treatment of formal Access to Information Act requests and consultations),
• management of privacy cases (treatment of formal and informal Privacy Act requests), and
• privacy impact assessments.

Whenever employees or contractors of the OAG participate in any ATIP-related activity, they must track the time they spend on the activity by entering the number of hours or partial hours into the product-code management software. These records are monitored on a regular basis for human resource and financial purposes. Any employee with access to the OAG network can use the OAG’s INTRAnet (internal Internet) to view this data.

As reflected in part 10.2 of Appendix B, the OAG dedicated 1.25 person-years to ATIP-related activities.

Breaches

No breaches of privacy occurred as a result of any OAG activity during the 2014–15 fiscal year.

Privacy impact assessments

No privacy impact assessments were completed during the 2014–15 fiscal year because no program or activity underwent any significant change that affected privacy.

Appendix B: Report on the Privacy Act

Name of institution: Office of the Auditor General of Canada

Reporting period: 2014-04-01 to 2015-03-31

Part 1: Requests Under the Privacy Act

Part 2: Requests Closed During the Reporting Period

2.1 Disposition and completion time

2.2 Exemptions

2.3 Exclusions

2.4 Format of information released

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

2.5.2 Relevant pages processed and disclosed by size of requests

2.5.3 Other Complexities

2.6 Deemed refusals

2.6.1 Reasons for not meeting statutory deadline

2.6.2 Number of days past deadline

2.7 Requests for translation

Part 3: Disclosures Under Subsections 8(2) and 8(5)

Part 4: Requests for Correction of Personal Information and Notations

Part 5: Extensions

5.1 Reasons for extensions and disposition of requests

5.2 Length of extensions

Part 6: Consultations Received From Other Institutions and Organizations

6.1 Consultations received from other Government of Canada institutions and other organizations

6.2 Recommendations and completion time for consultations received from other Government of Canada institutions

6.3 Recommendations and completion time for consultations received from other organizations

Part 7: Completion Time of Consultations on Cabinet Confidences

7.1 Requests with Legal Services

7.2 Requests with Privy Council Office

Part 8: Complaints and Investigations Notices Received

Part 9: Privacy Impact Assessments (PIAs)

Part 10: Resources related to the Privacy Act

10.1 Costs

10.2 Human Resources

Note: Enter values to two decimal places.