Annual Report on the Access to Information Act and the Privacy Act—2015–16

Annual Report on the Access to Information Act and the Privacy Act—2015–16

Annual Report on the Access to Information Act—2015–16

Introduction

When the Federal Accountability Act was enacted in 2006, amendments were made to the Access to Information Act and the Privacy Act, both of which came into force in 1983. The scope of application of these laws was expanded, and the Office of the Auditor General of Canada (OAG) became subject to the Access to Information Act.

The Access to Information Act gives Canadian citizens and permanent residents, and any person and corporation present in Canada, the right to access information contained in government records, subject to certain specific and limited exceptions.

Section 72 of the Act requires the head of each government institution to prepare an annual report on the administration of the Act within the institution and to submit the report to Parliament.

This annual report on the administration of the Access to Information Act at the OAG describes how we administered our responsibilities under the Act during the 2015–16 fiscal year.

If you require more information or wish to make a request under the Access to Information Act, please direct your inquiries to the following:

Who we are

The Office of the Auditor General of Canada (OAG) audits federal government operations and provides Parliament with independent information, advice, and assurance regarding the federal government’s stewardship of public funds. While the OAG may comment on policy implementation in an audit, it does not comment on policy itself.

We are in the business of legislative auditing. We conduct

• performance audits of federal departments and agencies;
• annual financial audits of the government’s financial statements;
• special examinations and annual financial audits of Crown corporations; and
• audits of the governments of Nunavut, Yukon, and the Northwest Territories.

Since 1995, the OAG has also had a specific environmental and sustainable development mandate, which was established through amendments to the Auditor General Act.

The Auditor General of Canada is the designated head of the institution for the Access to Information Act as well as the Privacy Act. Pursuant to section 73 of both acts, the Auditor General has delegated full authority to the Access to Information and Privacy Coordinator and senior general counsel.

Access to Information and Privacy Office

The Access to Information and Privacy (ATIP) Coordinator is accountable for the development and implementation of effective policies, guidelines, systems, and procedures to ensure that the Office of the Auditor General of Canada (OAG) meets its responsibilities under the Access to Information Act and the Privacy Act.

The ATIP Office at the OAG comprises

• one full-time ATIP Coordinator;
• two full-time employees from other groups at the OAG, who help the ATIP Office on a part-time, ad hoc basis; and
• one full-time legal counsel, who advises the ATIP Office on a part-time, ad hoc basis.

The main activities of the ATIP Coordinator include

• monitoring the OAG’s compliance with the requirements of the Access to Information Act, the Privacy Act, and associated regulations, procedures, and policies;
• processing requests under both acts;
• developing and maintaining policies, procedures, and guidelines to ensure that the OAG respects the acts;
• promoting awareness of the acts within the OAG to ensure that employees are aware of their responsibilities;
• preparing annual reports to Parliament and other statutory reports, as well as other material that may be required by central agencies;
• representing the OAG in dealings with the Treasury Board of Canada Secretariat, the information and privacy commissioners, and other government departments and agencies to determine how the acts apply to the OAG; and
• helping the OAG meet its commitments to ensure openness and transparency, through proactive and informal disclosure of information.

Highlights and accomplishments for the 2015–16 fiscal year

One hundred percent compliance

All formal Access to Information Act or Privacy Act requests received during the 2015–16 fiscal year met their legislative deadline. The Office of the Auditor General of Canada (OAG) is proud to have maintained 100 percent compliance with deadlines under both acts.

Privacy awareness and the new Privacy Framework

During the 2015–16 fiscal year, the OAG ATIP Coordinator began taking steps to raise awareness of the importance of treating personal information with elevated sensitivity.

In April 2015, a plan to develop and implement a new Privacy Framework was proposed, which included

• the development of a new Employee Privacy Policy,
• the enhancement of privacy notices and statements to the public, and
• mandatory privacy-specific training for OAG staff.

The plan is under way, with the goal of full implementation by the end of the 2016–17 fiscal year.

Training

Throughout the 2015–16 fiscal year, the ATIP Coordinator gave OAG staff seven separate presentations and information sessions that focused on personal information. A total of 185 employees attended these sessions.

In addition, awareness sessions and unit-specific training sessions include various ATIP components. During the 2015–16 fiscal year, 160 employees received six sessions of ATIP training that covered security awareness, access to information and privacy, information management, and information technology.

Administration of the Access to Information Act

Requests under the Access to Information Act

Sources of requests received

The majority of the requests for the reporting period were received from the public (8). Requests were also received from the media (5), businesses (3), and an organization (1).

Disposition of completed requests

The Office of the Auditor General of Canada (OAG) finalized 17 formal requests in the reporting period:

• 4 requests were disclosed in their entirety,
• 8 requests resulted in partial disclosure,
• 2 requests resulted in total exemption of all records,
• 2 requests could not be processed because no relevant records existed, and
• 1 request was abandoned by the requester.

Exemptions invoked

Appendix A indicates the number of requests in which specific types of exemptions were invoked. For example, if the OAG applied five different exemptions in processing a request, one exemption under each relevant section is reported—for a total of five. If the same exemption was claimed several times for the same request, it is reported only once.

As noted, the OAG invoked exemptions under sections 16(2), 16(2)(c), 16.1(1)(a), 19(1), 20(1)(a), 20(1)(b), 20(1)(c), 20(1)(d), 21(1)(a), 21(1)(b), 22, and 23 of the Access to Information Act.

Exclusions cited

The OAG did not invoke any exclusions pursuant to the Access to Information Act for the reporting period.

Extension of time limits

Section 9 of the Act provides for the extension of the statutory time limits if consultations are necessary, or if a large number of records have been requested and processing the request within the original time limit would unreasonably interfere with OAG operations.

Of the 17 requests responded to during the reporting period,

• 6 requests were extended for 30 days or less, pursuant to section 9(1)(a);
• 1 request was extended for 31 to 60 days, pursuant to section 9(1)(a);
• 3 requests were extended for 30 days or less, pursuant to section 9(1)(b); and
• 4 requests were extended for more than 30 days, pursuant to section 9(1)(c).

Completion time

Of the 17 requests completed during the reporting period,

• 9 were completed by the original 30-day deadline,
• 3 required up to an additional 30 days, and
• 5 required between 61 and 120 days.

Method of access

Where the relevant documents were given either in part or in their entirety, paper copies of documents were provided for four requests, and electronic copies were provided for eight requests.

Fees

The fees collected during the reporting period totalled $75. The OAG’s practice is to waive photocopy or search fees. During the reporting period, the $5 application fee was waived in two instances because of exceptional circumstances.

Costs

The costs directly associated with administration of the Access to Information Act for the reporting period are estimated to be $98,094 for salaries and $2,856 for goods and services, for a total of $100,950.

Complaints and investigations

The OAG has not received any complaints since the 2011–12 fiscal year.

Institution-specific policies, guidelines, and procedures

The OAG did not revise policies, guidelines, or procedures—or implement new ones—during the 2015–16 fiscal year.

Monitoring

The OAG uses time-code (product-code) management software, essentially a digital “timesheet,” to track all audit and audit-service activities, including

• management of the Access to Information and Privacy (ATIP) Office,
• management of access to information cases (treatment of formal Access to Information Act requests and consultations),
• management of privacy cases (treatment of formal and informal Privacy Act requests), and
• privacy impact assessments.

Whenever employees or contractors of the OAG participate in any ATIP-related activity, they must track the time they spend on the activity by entering the number of hours or partial hours into the product-code management software. These records are monitored on a regular basis for human resource and financial purposes. Any employee with access to the OAG network can use the OAG’s INTRAnet (internal Internet) to view this data.

As reflected in part 9.2 of Appendix A, the OAG dedicated 1.25 person-years to ATIP-related activities.

Appendix A: Statistical Report on the Access to Information Act

Name of institution: Office of the Auditor General of Canada

Reporting period: 2015-04-01 to 2016-03-31

Part 1: Requests Under the Access to Information Act

1.1 Number of Requests

1.2 Sources of requests

1.3 Informal requests

Note: All requests previously recorded as “treated informally” will now be accounted for in this section only.

Part 2: Requests Closed During the Reporting Period

2.1 Disposition and completion time

2.2 Exemptions

2.3 Exclusions

2.4 Format of information released

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

2.5.2 Relevant pages processed and disclosed by size of requests

2.5.3 Other complexities

2.6 Deemed refusals

2.6.1 Reasons for not meeting statutory deadline

2.6.2 Number of days past deadline

2.7 Requests for translation

Part 3: Extensions

3.1 Reasons for extensions and disposition of requests

3.2 Length of extensions

Part 4: Fees

Part 5: Consultations Received From Other Institutions and Organizations

5.1 Consultations received from other Government of Canada institutions and organizations

5.2 Recommendations and completion time for consultations received from other Government of Canada institutions

5.3 Recommendations and completion time for consultations received from other organizations

Part 6: Completion Time of Consultations on Cabinet Confidences

6.1 Requests with Legal Services

6.2 Requests with Privy Council Office

Part 7: Complaints and Investigations

Part 8: Court Action

Part 9: Resources related to the Access to Information Act

9.1 Costs

9.2 Human Resources

Annual Report on the Privacy Act—2015–16

Introduction

The Privacy Act gives individuals the right to access information about themselves that is held by the Office of the Auditor General of Canada (OAG), subject to certain specific and limited exceptions. The Privacy Act also protects the privacy of individuals by giving them substantial control over the collection, use, and disclosure of their personal information and by preventing others from having access to that information.

Section 72 of the Act requires the head of each government institution to prepare an annual report on the administration of the Act within the institution and to submit the report to Parliament.

This annual report on the administration of the Privacy Act at the OAG describes how we administered our responsibilities under the Act during the 2015–16 fiscal year.

If you require more information or wish to make a request under the Privacy Act, please direct your inquiries to the following:

Who we are

The Office of the Auditor General of Canada (OAG) audits federal government operations and provides Parliament with independent information, advice, and assurance regarding the federal government’s stewardship of public funds. While the OAG may comment on policy implementation in an audit, it does not comment on policy itself.

We are in the business of legislative auditing. We conduct

• performance audits of federal departments and agencies;
• annual financial audits of the government’s financial statements;
• special examinations and annual financial audits of Crown corporations; and
• audits of the governments of Nunavut, Yukon, and the Northwest Territories.

Since 1995, the OAG has also had a specific environmental and sustainable development mandate, which was established through amendments to the Auditor General Act.

The Auditor General of Canada is the designated head of the institution for the Access to Information Act as well as the Privacy Act. Pursuant to section 73 of both acts, the Auditor General has delegated full authority to the Access to Information and Privacy Coordinator and senior general counsel.

Access to Information and Privacy Office

The Access to Information and Privacy (ATIP) Coordinator is accountable for the development and implementation of effective policies, guidelines, systems, and procedures to ensure that the Office of the Auditor General of Canada (OAG) meets its responsibilities under the Access to Information Act and the Privacy Act.

The ATIP Office at the OAG comprises

• one full-time ATIP Coordinator;
• two full-time employees from other groups at the OAG, who help the ATIP Office on a part-time, ad hoc basis; and
• one full-time legal counsel, who advises the ATIP Office on a part-time, ad hoc basis.

The main activities of the ATIP Coordinator include

• monitoring the OAG’s compliance with the requirements of the Access to Information Act, the Privacy Act, and associated regulations, procedures, and policies;
• processing requests under both acts;
• developing and maintaining policies, procedures, and guidelines to ensure that the OAG respects the acts;
• promoting awareness of the acts within the OAG to ensure that employees are aware of their responsibilities;
• preparing annual reports to Parliament and other statutory reports, as well as other material that may be required by central agencies;
• representing the OAG in dealings with the Treasury Board of Canada Secretariat, the information and privacy commissioners, and other government departments and agencies to determine how the acts apply to the OAG; and
• helping the OAG meet its commitments to ensure openness and transparency, through proactive and informal disclosure of information.

Administration of the Privacy Act

Requests under the Privacy Act

Disposition of completed requests

The Office of the Auditor General of Canada (OAG) finalized four requests in the 2015–16 fiscal year. Two requests were disclosed in part, one request yielded no records, and one request was abandoned by the applicant.

Exemptions invoked

Appendix B indicates the number of requests where specific types of exemptions were invoked. For example, if the OAG applied five different exemptions in processing a request, one exemption under each relevant section is reported—for a total of five. If the same exemption was claimed several times for the same request, it is reported only once.

For the two requests that were disclosed in part, the exemption provision stipulated in section 26 of the Privacy Act was invoked.

Exclusions cited

The OAG did not invoke any exclusions pursuant to the Privacy Act for the reporting period.

Completion time

Of the four requests completed during the reporting period,

• two were completed by the original 30-day deadline,
• one was abandoned by the applicant within the original 30-day deadline, and
• one required an additional 30 days to complete, because of interference with operations, pursuant to section 15(a)(i). This request yielded nearly 800,000 pages of records, only 671 pages of which were relevant to the request. The request was successfully processed and responded to within the extended deadline.

Extension of time limits

During the reporting period, one request was extended for 30 days because of interference with operations, pursuant to section 15(a)(i).

Method of access

For the two requests that were disclosed in part, the records were disclosed to the applicants in electronic format.

Costs

The costs directly associated with administration of the Privacy Act for the reporting period are estimated to be $75,485 for salaries. No costs were incurred for goods and services, contracts, or other expenses.

Complaints and investigations

The OAG did not receive any complaints pursuant to the Privacy Act during this reporting period, and no investigations regarding the OAG were carried out.

Disclosure of personal information under section 8(2)

During the reporting period, one disclosure was made pursuant to section 8(2)(m) of the Privacy Act. Notification was given to the Office of the Privacy Commissioner at the time of disclosure.

Institution-specific policies, guidelines, and procedures

The OAG did not revise policies, guidelines, or procedures—or implement new ones—during the reporting period.

Monitoring

The OAG uses time-code (product-code) management software, essentially a digital “timesheet,” to track all audit and audit-service activities, including

• management of the Access to Information and Privacy (ATIP) Office,
• management of access to information cases (treatment of formal Access to Information Act requests and consultations),
• management of privacy cases (treatment of formal and informal Privacy Act requests), and
• privacy impact assessments.

Whenever employees or contractors of the OAG participate in any ATIP-related activity, they must track the time they spend on the activity by entering the number of hours or partial hours into the product-code management software. These records are monitored on a regular basis for human resource and financial purposes. Any employee with access to the OAG network can use the OAG’s INTRAnet (internal internet) to view this data.

As reflected in part 10.2 of Appendix B, the OAG dedicated 1.25 person-years to ATIP-related activities.

Breaches

No breaches of privacy occurred as a result of any OAG activity during the reporting period.

Privacy impact assessments

No privacy impact assessments were completed during the reporting period because no program or activity underwent any significant change that affected privacy.

Appendix B: Statistical Report on the Privacy Act

Name of institution: Office of the Auditor General of Canada

Reporting period: 2015-04-01 to 2016-03-31

Part 1: Requests Under the Privacy Act

Part 2: Requests Closed During the Reporting Period

2.1 Disposition and completion time

2.2 Exemptions

2.3 Exclusions

2.4 Format of information released

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

2.5.2 Relevant pages processed and disclosed by size of requests

2.5.3 Other complexities

2.6 Deemed refusals

2.6.1 Reasons for not meeting statutory deadline

2.6.2 Number of days past deadline

2.7 Requests for translation

Part 3: Disclosures Under Subsections 8(2) and 8(5)

Part 4: Requests for Correction of Personal Information and Notations

Part 5: Extensions

5.1 Reasons for extensions and disposition of requests

5.2 Length of extensions

Part 6: Consultations Received From Other Institutions and Organizations

6.1 Consultations received from other Government of Canada institutions and other organizations

6.2 Recommendations and completion time for consultations received from other Government of Canada institutions

6.3 Recommendations and completion time for consultations received from other organizations

Part 7: Completion Time of Consultations on Cabinet Confidences

7.1 Requests with Legal Services

7.2 Requests with Privy Council Office

Part 8: Complaints and Investigations Notices Received

Part 9: Privacy Impact Assessments (PIAs)

Part 10: Resources related to the Privacy Act

10.1 Costs

10.2 Human Resources