Office of the Auditor General of CanadaAnnual Report on the Privacy Act—2023–24

Introduction

The Privacy Act gives individuals the right to access information about themselves that is held by the Office of the Auditor General of Canada (OAG), subject to certain specific and limited exceptions. The Privacy Act also protects individuals’ privacy by giving them substantial control over the collection, use, and disclosure of their personal information and by preventing others from having access to that information.

Section 72 of the act requires the head of each government institution to prepare an annual report on the administration of the act within the institution and to submit the report to Parliament.

This annual report on the Privacy Act at the OAG describes how we administered our responsibilities under the act during the 2023–24 fiscal year.

Who we are

The OAG audits federal government operations and provides Parliament with independent information, advice, and assurance regarding the federal government’s stewardship of public funds.

We are in the business of legislative auditing. We conduct

• performance audits of federal organizations
• annual financial audits of the government’s financial statements
• special examinations and annual financial audits of Crown corporations
• audits of the governments of Nunavut, Yukon, and the Northwest Territories

Since 1995, the OAG has also had a specific environmental and sustainable development mandate, which is carried out by the Commissioner of the Environment and Sustainable Development on behalf of the Auditor General of Canada. The Commissioner has additional responsibilities under the Federal Sustainable Development Act and the Canadian Net-Zero Emissions Accountability Act to review and monitor the Government of Canada’s sustainable development strategies and its implementation of measures aimed at mitigating climate change.

Access to Information and Privacy team

The Access to Information and Privacy (ATIP) Coordinator is a member of the Legal Services, ATIP, and Policy team headed by the OAG’s Senior General Counsel. The full-time ATIP Coordinator is supported by an ATIP analyst and paralegal, legal counsel, and administrative staff as required. The main activities of the ATIP team included

• monitoring compliance with ATIP legislation and relevant procedures and policies
• processing requests under both the Access to Information Act and the Privacy Act
• developing and maintaining policies, procedures, and guidelines to ensure that the OAG respected the Access to Information Act and the Privacy Act
• promoting awareness of the Access to Information Act and the Privacy Act within the OAG to ensure that employees were aware of their responsibilities
• preparing annual reports to Parliament, other statutory reports, and other materials that central agencies might require
• representing the OAG in dealings with the Treasury Board of Canada Secretariat, the information and privacy commissioners, and other government organizations in matters pertaining to the Access to Information Act and the Privacy Act
• helping the OAG meet its commitments to ensure openness and transparency, through proactive and informal disclosure of information

Performance in 2023–24

During the reporting period, from 1 April 2023 to 31 March 2024, the OAG did not receive any formal requests for personal information under the Privacy Act. However, the OAG received multiple requests for personal information under the Access to Information Act and a significant number of informal requests for personal information.

The OAG did not receive any complaints during the reporting period.

Trends

The OAG responds to multiple requests throughout the year from individuals seeking informal feedback, input, or advice regarding whether they should submit a formal request for their personal information, either to the OAG or to another institution.

The OAG processed and completed a total of 5 formal requests for personal information during the past 4 reporting periods, including the period of this report.

The OAG assists with or redirects multiple requests for personal information annually, as many individuals believe that the OAG either has their personal information or through the course of audits, has collected their personal information. Additionally, many individuals believe that the OAG should audit the subject of their grievances against the federal government. While these are not processed as formal requests for information, they can often result in prolonged efforts to address individuals’ concerns and ascertain which department, if any, should receive their request.

Training and awareness

The OAG requires that all employees complete mandatory ATIP training, offered by the Canada School of Public Service as an online, self-paced course.

All new OAG employees are required to complete the training within 3 months of the start date of their employment.

During the reporting period, 115 employees completed this training.

The ATIP Coordinator regularly provides OAG employees with guidance and briefings on the processing of ATIP requests. Furthermore, information is available on the OAG’s internal website to help raise employees’ awareness of privacy issues, such as the collection, retention, use, and disclosure of personal information.

Policies, guidelines, and procedures

To help employees identify and mitigate privacy breaches, during the reporting period, the OAG drafted and has since internally published a privacy breach protocol that includes links to helpful resources from the Office of the Privacy Commissioner of Canada and the Treasury Board of Canada Secretariat.

Initiatives and projects to improve privacy

The OAG has engaged outside parties and is planning the procurement of request processing software. Our current plans are to join other federal government organizations in using a platform hosted by Shared Services Canada.

The OAG continues to progress toward further implementation of anonymization (or de-identification) measures for personal information found in audit records.

Complaints and investigations

The OAG did not receive any complaints pursuant to the Privacy Act during this reporting period, and no investigations regarding the OAG were carried out.

Material privacy breaches

One material privacy breach occurred during the reporting period. The OAG was notified of a privacy breach at Brookfield Global Relocation Services on 20 October 2023. The breach of information affected all federal government departments that had relocated employees using Brookfield Global Relocation Services since 2001. The OAG notified potentially affected employees individually by email except for individuals on extended leave, who had departed the OAG, or whose contact information was unavailable. On request, potentially affected employees were provided with activation codes for credit monitoring and identity theft protection offered by Equifax. The Office of the Privacy Commissioner of Canada and the Treasury Board of Canada Secretariat were notified as recommended by both entities in government-wide communications.

Completed privacy impact assessments

Retain system upgrade

The purpose of implementing Retain Corporate Software version 7 was to continue to be able to efficiently schedule audit resources, define and store comprehensive skills information, produce various reports, and allow real-time access to audit schedules through a standard web browser. The new version of Retain includes several features and utilities, which include the use of some personal information, which is used for audit planning purposes and will not be shared outside of the OAG.

Learning management system—Modified assessment

The Learning Management System replaced the OAG’s professional development and learning tool, Learning Management Solution and OAG Campus. The new system is an amalgamation of internal and external training and compliance management and monitoring. Although the system mostly uses non-personal employee information, it does use some personal information of OAG employees. The new system also uses some cloud-based data storage.

The privacy impact assessment completed in the 2022–23 reporting period was modified during the 2023–24 reporting period because of updates to the OAG Campus offerings and certain surveys and questionnaires offered to employees.

Preliminary (informal) assessments

For all new or amended projects, the OAG has implemented a mandatory process that requires the completion of a preliminary privacy assessment checklist. This document ensures that personal information elements are considered before and during the completion of the project.

This process also identifies the required elements for a formal privacy impact assessment, which is initiated if the preliminary assessment identifies the need for one.

During the reporting period, the OAG completed 27 preliminary assessments.

Public interest disclosures

The OAG did not disclose any personal information pursuant to section 8(2) during the reporting period.

Monitoring compliance

The OAG uses time tracking software to monitor and track privacy-related activities and functions, including employees’ attendance at privacy information and training sessions.

As noted in this report, preliminary privacy assessments are completed when projects may include elements of personal information collection or use. The ATIP team uses software to track and monitor these projects.

The OAG uses standard language in contracts, agreements, and arrangements, which include requirements for the protection and provision of personal information.

The OAG complies with Treasury Board directives, policies, and guidelines where applicable. The OAG Information and Data Management group ensures that all necessary actions are taken within the legislated or recommended deadline or time frame.

Requests for correction of personal information

No requests for correction of personal information were received during the reporting period.

Appendix—Statistical Report on the Privacy Act

Statistical Report on the Privacy Act

Name of institution: Office of the Auditor General of Canada

Reporting period: 2023-04-01 to 2024-03-31

Section 1: Requests Under the Privacy Act

1.1 Number of requests received

1.2 Channels of requests

Section 2: Informal requests

2.1 Number of informal requests

2.2 Channels of informal requests

2.3 Completion time of informal requests

2.4 Pages released informally

Section 3: Requests Closed During the Reporting Period

3.1 Disposition and completion time

3.2 Exemptions

3.3 Exclusions

3.4 Format of information released

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper, e‑record and dataset formats

3.5.2 Relevant pages processed by request disposition for paper, e‑record and dataset formats by size of requests

3.5.3 Relevant minutes processed and disclosed for audio formats

3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests

3.5.5 Relevant minutes processed and disclosed for video formats

3.5.6 Relevant minutes processed per request disposition for video formats by size of requests

3.5.7 Other complexities

3.6 Closed requests

3.6.1 Number of requests closed within legislated timelines

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines

3.7.2 Requests closed beyond legislated timelines (including any extension taken)

3.8 Requests for translation

Section 4: Disclosures Under Subsections 8(2) and 8(5)

Section 5: Requests for Correction of Personal Information and Notations

Section 6: Extensions

6.1 Reasons for extensions

6.2 Length of extensions

Section 7: Consultations Received From Other Institutions and Organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada

Section 8: Completion Time of Consultations on Cabinet Confidences

8.1 Requests with Legal Services

8.2 Requests with Privy Council Office

Section 9: Complaints and Investigations Notices Received

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

10.1 Privacy impact assessments

10.2 Institution-specific and central personal information banks

Section 11: Privacy Breaches

11.1 Material privacy breaches reported

11.2 Non-material privacy breaches

Section 12: Resources Related to the Privacy Act

12.1 Allocated costs

12.2 Human resources