2014–15 Annual Reports on the Access to Information Act and the Privacy Act

1.1 Introduction

The Access to Information Act gives Canadian citizens, permanent residents, and all individuals and corporations present in Canada the right of access to records under the control of a government institution subject to the Act. The Act complements, but does not replace, other means of obtaining government information.

This report is prepared and tabled in Parliament in accordance with section 72 of the Access to Information Act. It covers the period from April 1, 2014, to March 31, 2015.

1.2 Mandate of the Treasury Board of Canada Secretariat

The Treasury Board of Canada Secretariat (Secretariat) is the administrative arm of the Treasury Board, and the President of the Treasury Board is the Minister responsible for the Secretariat. This organization supports the Treasury Board by making recommendations and providing advice on program spending, regulations and management policies and directives, while respecting the primary responsibility of deputy heads in managing their organizations, and their roles as accounting officers before Parliament. In this way, the Secretariat strengthens the way government is managed and helps to ensure value for money in government spending and results for Canadians.

Through the Office of the Chief Human Resources Officer, the Secretariat provides government-wide leadership on people management; through the Office of the Chief Information Officer, it offers direction, oversight and capacity building for information management, information technology, government security (including identity management), access to information, privacy, and internal and external service delivery. The Secretariat is also responsible for the comptrollership function of the government.

Under the broad authority of sections 5 to 13 of the Financial Administration Act, the Secretariat supports the Treasury Board in its role as the general manager and employer of the public service.

1.3 Organization

The Access to Information and Privacy (ATIP) Office is part of the Ministerial Services Division of the Secretariat’s Strategic Communications and Ministerial Affairs Sector. The ATIP Office coordinates responses to ATIP requests and consultations from other government institutions, for the Secretariat as a department. This office also provides advice to the Secretariat’s employees as they fulfill their obligations under the Access to Information Act and the Privacy Act.

The ATIP Office has ten full-time positions to fulfill the Secretariat’s obligations under the Access to Information Act and the Privacy Act. Nine of these positions were filled during the reporting period—a director and eight ATIP officers at various levels. For seven of the eight officers, work ranged from processing ATIP requests to carrying out consultations with government organizations or third parties and responding to calls and informal requests for information. The eighth senior privacy analyst was hired to respond to an increasing volume of privacy policy–related work.

1.4 Delegation Orders

Delegation orders set out what powers, duties and functions for the administration of the Access to Information Act have been delegated by the head of the institution, and to whom. The President of the Treasury Board has delegated most of the responsibilities set out in the Access to Information Act and the Privacy Act to the ATIP Director and the Senior Director, Ministerial Services, Strategic Communications and Ministerial Affairs, within the Secretariat. The Secretary has been delegated responsibilities for addressing complaints not resolved between the ATIP Office and investigators from the Office of the Information Commissioner and the Office of the Privacy Commissioner.

1.5 Statistical Report

Statistical reporting on the administration of the Access to Information Act and the Privacy Act has been in place since 1983. The statistical reports prepared by government institutions provide aggregate data on the application of the Access to Information Act and Privacy Act legislation. This information is made public on an annual basis in an Info Source Bulletin and is included with the annual reports on access to information and privacy tabled in Parliament by each institution.

The Secretariat’s 2014–15 statistical report on the Access to Information Act is provided in Appendix A.

1.6 Interpretation of the Statistical Report for Requests Under the Access to Information Act

In the reporting period from April 1, 2014, to March 31, 2015, the Secretariat received a total of 427 new requests under the Access to Information Act. This represents a decrease of 151 requests (26%) from last year’s total of 578. In addition to the new requests, 75 requests were carried forward from 2013–14. One of the 75 carried over had been abandoned in the previous reporting period; however, this fact was not reflected in the previous report to Parliament.

One factor that may have contributed to the lower number of requests was the onboarding of additional departments to the ATIP online initiative. Requestors were able to submit their online requests directly to the department of greater interest in the records, rather than fielding them through the Secretariat.

Of the 427 requests received during the 2014–15 reporting period, 171 (40%) came from the public; the remaining 60% were requests from the media (124 requests or 29%), businesses (45 requests or 11%), academia (8 requests or 2%), individuals who declined to identify themselves (60 requests or 14%), and organizations (19 requests or 4%).

A total of 121 new requests (28%), whose subjects were outside the Secretariat’s mandate or for which the Secretariat had no records, were transferred or redirected to other federal institutions.

In 2014–15, the Secretariat’s ATIP Office responded to formal access to information requests involving the review of 34,808 pages (22,367 fewer pages, or 39% less than last year). The Secretariat recommended for release 23,920 pages (69%) of the 34,808 pages reviewed. This reflects the nature of the Secretariat’s work, which involves a large number of Cabinet confidences.

The decrease in the total volume of pages processed can be attributed to an overall decrease in requests received, as well as to the following two key factors:

• Proactive posting of frequently sought information and completed access to information summaries on the government’s Open Data Portal; and
• Proactive negotiation with the requestors on files that had a large volume of records to reduce superfluous information and expedite processing.

About 59% of the access to information requests (249 requests) involved the review and processing of up to 500 pages. Five cases involved the release of a total of 8,994 pages, averaging about 1,799 pages for each case. Processing of such large files takes significantly longer and requires closer attention to ensure the internal consistency and proper sequencing of records.

In 159 cases of full or partial disclosure, requestors wanted to receive the information in a paper copy, and in 48 cases of full or partial disclosure, records were sought and provided in an electronic format. Requestors continue to have the option of receiving information on CD-ROM at no extra charge, which eliminates the cost of photocopies.

By way of summary, Table 1 presents an overview of the 2014–15 statistics on the Secretariat’s processing of access to information requests in relation to statistics for the three previous years.

Table 1 shows the latest three-year trend of the Secretariat’s processing of access to information requests.

1.7 Other Requests

During the reporting period, the Secretariat received 247 access to information consultation requests from other federal organizations involving Secretariat records or issues, an increase of 74 requests (43%) from the previous year. The Secretariat was asked to review a total of 10,439 pages of information as part of these consultations. Some of these consultations involved the Secretariat’s collaboration or involvement in high profile issues such as cyber-security and the October 22 shooting at the War Memorial.

The ATIP Office processed 89 informal requests (i.e., not subject to the Access to Information Act), as compared with 159 informal requests the previous year (a decrease of 44%). Informal requests are processed as part of the Secretariat’s broader objective of providing Canadians with relevant information on an informal and timely basis, and in the spirit of transparency and open government.

As in previous years, the ATIP Office acted as a source of expertise for Secretariat officials, providing advice and guidance on the provisions of the legislation. The Office was consulted regularly on the disclosure and collection of data on a wide range of subjects, and provided advice to ensure transparency and compliance with the legislation. This included consultations on publications to be posted on the Open Government website, surveys and forms, and proactive disclosures on travel and hospitality; advice on information management and security of information; and the review of audits to be posted on the Internet.

Throughout the year, the ATIP Office continued to receive frequent telephone calls and emails from the general public seeking guidance on how to obtain information under the Access to Information Act and the Privacy Act, and where to forward their requests. Many of these enquiries were redirected to the Royal Canadian Mounted Police, Service Canada, the Canada Border Services Agency, Citizenship and Immigration Canada, and occasionally, to provincial Freedom of Information and Privacy Offices.

1.8 Disposition of Completed Requests

In 2014–15, a total of 419 requests were completed, with information disclosed in accordance with the provisions of the legislation. Table 2 provides an overview of the disposition of the completed requests.

Most requests that fell within the Secretariat’s mandate were only partially disclosed due to the nature of the Secretariat’s business, which involves a significant number of Cabinet confidences and sensitive advice and recommendations to the President. Due to the President’s responsibility for ensuring compliance with the Access to Information Act and the Privacy Act government-wide, the Secretariat receives a large number of requests that fall within the mandates of other federal departments. Such requests are registered, reviewed and redirected to the appropriate organization. In Table 2, these requests are presented under “Transferred to another institution” and “No existing records.”

1.9 Completion Time and Extensions

The legislation sets timelines for responding to access to information requests and allows for extensions when the response requires the review of a large amount of information or extensive consultations with other organizations.

Table 3 provides the response times for the 419 access to information requests that the Secretariat completed in 2014–15.

The Secretariat received a number of requests that fell under other government organizations’ mandates; these requests were completed within 1 to 15 days. Requests that were processed after the initial 30 days required consultations with other federal organizations or the Secretariat’s Legal Services Division in order to confirm Cabinet confidences. During the reporting period, the Secretariat sought extensions in 117 instances (28%) mainly to consult with other government institutions or third parties, but in some cases, because the original time limit unreasonably interfered with operations. Overall, of the 419 requests, 402 (96%) were completed within the prescribed time limits, including all extensions, which were taken in accordance with sub-paragraphs 9(1)(a), (b) and (c) of the Access to Information Act.

As in the previous year, the access to information requests that the Secretariat received were complex and often required cross-departmental, regional or cross-jurisdictional data that were not readily available. These requests resulted in requestors paying additional search and retrieval fees as well as programming fees.

Several factors contributed to the Secretariat’s on-time response rate of 96%: weekly statistical performance reports, strong case file management, information sessions with Secretariat officials and sector contacts, and a streamlined process for confirmation of Cabinet confidences and delegation orders.

1.10 Exemptions Invoked

The Access to Information Act allows, and in some instances requires, that information relating to the internal decision-making processes of government, national security, law enforcement or trade secrets be exempted and not released.

In 2014–15, the Secretariat invoked a total of 584 exemptions as per specific sections of the Access to Information Act. The breakdown of the exemptions is as follows:

Section 13:

Exempting records obtained in confidence from other levels of government (5);

Section 15:

Exempting records expected to be injurious to the conduct of international affairs and the defence of Canada (58);

Section 16:

Exempting records containing law enforcement and security information (37);

Section 18:

Exempting records expected to prejudice the economic interests of Canada (53);

Section 19:

Exempting records containing personal information (58);

Section 20:

Exempting records containing third-party business information (43);

Section 21:

Exempting records containing information related to the internal decision-making processes of government (281);

Section 22:

Exempting records containing test procedures, tests and audits (3);

Section 23:

Exempting records related to solicitor-client privilege (43); and

Section 26:

Exempting records where information is to be published within 90 days (3).

1.11 Exclusions Invoked

The Access to Information Act does not apply to information that is already publicly available, such as government publications and material in libraries and museums. It also excludes material such as Cabinet confidences. Consistent with the Act, exclusions were invoked 144 times: 6 times for information that could be found in the public domain (section 68(a)) and 138 times under section 69 for confidences of the Queen’s Privy Council for Canada. A large number of Secretariat documents are classified as Cabinet confidences due to the fact that the Secretariat provides administrative support to the Treasury Board, which is a Cabinet committee.

1.12 Fees

During the reporting period, the Secretariat collected $1,445 in application fees, $359 in search fees, $350 in programming fees, and $92 for reproduction of material to be released or for response preparation time.

1.13 Costs

During 2014–15, the ATIP Office incurred $457,653 in salary costs and $31,400 in administrative costs (software licences, professional services fees, office equipment and supplies, training) to administer the Access to Information Act.

These costs do not include resources expended by the Secretariat’s program areas to meet the requirements of the Acts.

1.14 Education and Training

During 2014–15, the ATIP Office continued to conduct training sessions for the Secretariat’s employees on a regular basis—seven sessions were provided to 52 staff. Some of these sessions were tailored to the specific needs of divisional teams and sectors across the Secretariat.

1.15 Policies, Guidelines, Procedures and Initiatives

To make the process of requesting government records simpler and more convenient, on April 9, 2013, the Government of Canada launched a pilot initiative that enables Canadians to submit their ATIP requests and fees online. The participants in the pilot were Citizenship and Immigration Canada, Shared Services Canada and the Treasury Board of Canada Secretariat. The service has now been expanded to include 29 federal government institutions, making it easier to submit an access to information or privacy request across government. This initiative is part of the modernization of the administration of access to information, one of the commitments of Canada’s Action Plan on Open Government.

During the reporting period, a total of 225 (41%) of the 547 formal ATIP requests were submitted to the Secretariat’s ATIP Office using the ATIP online request service. This is an increase of three percentage points from last year when a total of 271 (37.5%) of the 722 requests were submitted using the online service.

To ensure policy compliance and adherence to procedures for appropriate handling and preparation of responses to ATIP requests, the Secretariat’s ATIP Office disseminated a variety of tools and checklists, and held face-to-face meetings to share these tools with new staff and contacts. These tools and meetings were instrumental in ensuring that the Secretariat’s employees remain aware of their roles and responsibilities related to ATIP requests.

1.16 Complaints, Investigations and Federal Court Cases

Clients of the Secretariat filed 4 new complaints with the Information Commissioner in 2014–15, a decrease of 15 complaints from the previous reporting period’s total of 19.

The reasons for the new complaints were as follows:

• Three complaints related to the exemption or exclusion of information.
• One complaint pertained to time limits (i.e., extensions taken or time taken to respond to requests).

These four complaints dealt with formal requests made under the Access to Information Act.

During the reporting period, a total of five complaint investigations, all carried over from the previous year, were completed. The results were as follows:

• Three complaints were withdrawn by the complainant.
• One complaint regarding exemptions invoked resulted in a section 35 notice (request for formal representations by the institution) that concluded in a well-founded complaint (section 37), and additional records were provided to the applicant.
• One complaint regarding exemptions was settled in the course of the investigation.

All completed complaints dealt with formal responses to requests made under the Access to Information Act.

There were no new court cases in 2014–15. There have been no new court cases against the Secretariat in relation to the Access to Information Act and the Privacy Act in the last seven years.

1.17 Information Holdings

The ATIP Office distributes weekly compliance statistics that are shared with the program areas and senior management for all access to information requests.

1.18 Information Holdings

Info Source is a series of publications containing information about, and collected by, the Government of Canada. The primary purpose of Info Source is to assist individuals in exercising their rights under the Access to Information Act and the Privacy Act. Info Source also supports the federal government’s commitment to facilitate access to information regarding its activities.

A description of the Secretariat’s functions, programs, activities and related information holdings can be found in Treasury Board Secretariat - Sources of Federal Government and Employee Information 2014 (Info Source).

This year, the Secretariat’s ATIP Office assessed the 2013 and 2014 Info Source recommendations from the Secretariat’s Information and Privacy Policy Division. The ATIP Office will be implementing some of the recommendations for the 2015 Info Source update and has developed a three-year action plan to address identified shortcomings, such as updating the description of document types and collapsing certain redundant personal information banks, while re-registering others.

All Info Source publications are available online free of charge.

2.1 Introduction

The Privacy Act provides Canadian citizens and permanent residents with the right of access to, and correction of, personal information about themselves that is under the control of a government institution. The Act also provides the legal framework for the collection, retention, use, disclosure, disposition and accuracy of personal information in the administration of programs and activities by government institutions subject to the Act.

Under the Privacy Act, personal information is defined as “information about an identifiable individual that is recorded in any form.” Examples include information relating to the race, national or ethnic origin, colour, religion, age or marital status of an individual; the education or the medical, criminal, financial or employment history of an individual; the address, fingerprints or blood type of an individual; and any identifying number, symbol or other particular identifier assigned to an individual.

This report has been prepared and tabled in Parliament in accordance with section 72 of the Privacy Act. It covers the period from April 1, 2014, to March 31, 2015.

2.2 Mandate of the Treasury Board of Canada Secretariat

The Treasury Board of Canada Secretariat (Secretariat) is the administrative arm of the Treasury Board, and the President of the Treasury Board is the Minister responsible for the Secretariat. This organization supports the Treasury Board by making recommendations and providing advice on program spending, regulations and management policies and directives, while respecting the primary responsibility of deputy heads in managing their organizations, and their roles as accounting officers before Parliament. In this way, the Secretariat strengthens the way government is managed and helps to ensure value for money in government spending and results for Canadians.

Through the Office of the Chief Human Resources Officer, the Secretariat provides government-wide leadership on people management; through the Office of the Chief Information Officer, it offers direction, oversight and capacity building for information management, information technology, government security (including identity management), access to information, privacy, and internal and external service delivery. The Secretariat is also responsible for the comptrollership function of the government.

Under the broad authority of sections 5 to 13 of the Financial Administration Act, the Secretariat supports the Treasury Board in its role as the general manager and employer of the public service.

2.3 Organization

The Access to Information and Privacy (ATIP) Office is part of the Ministerial Services Division of the Secretariat’s Strategic Communications and Ministerial Affairs Sector. The ATIP Office coordinates responses to ATIP requests and consultations from other government institutions, for the Secretariat as a department. This office also provides advice to the Secretariat’s employees as they fulfill their obligations under the Access to Information Act and the Privacy Act.

The ATIP Office has ten full-time positions to fulfill the Secretariat’s obligations under the Access to Information Act and the Privacy Act. Nine of these positions were filled during the reporting period—a director and eight ATIP officers at various levels. For seven of the eight officers, work ranged from processing ATIP requests to carrying out consultations with government organizations or third parties and responding to calls and informal requests for information. The eighth senior privacy analyst was hired to respond to an increasing volume of privacy policy–related work.

2.4 Delegation Orders

Delegation orders set out what powers, duties and functions for the administration of the Privacy Act have been delegated by the head of the institution, and to whom. The President of the Treasury Board has delegated most of the responsibilities of the Access to Information Act and the Privacy Act to the ATIP Director and the Senior Director, Ministerial Services, Strategic Communications and Ministerial Affairs, within the Secretariat. The Secretary has been delegated responsibilities for addressing complaints not resolved between the ATIP Office and investigators from the Office of the Information Commissioner and the Office of the Privacy Commissioner.

Copies of the approved Secretariat delegation orders can be found in Appendix C.

2.5 Statistical Report

Statistical reporting on the administration of the Access to Information Act and the Privacy Act has been in place since 1983. The statistical reports prepared by government institutions provide aggregate data on the application of the Access to Information Act and Privacy Act legislation. This information is made public on an annual basis in an Info Source Bulletin and is included with the annual reports on access to information and privacy, which are tabled in Parliament by each institution.

The Secretariat’s 2014–15 statistical report on the Privacy Act is provided in Appendix B.

2.6 Interpretation of the Statistical Report for Requests Under the Privacy Act

In the reporting period from April 1, 2014, to March 31, 2015, the Secretariat received a total of 120 new requests under the Privacy Act. This represents a decrease of 24 requests (17%) from last year’s total of 144. In addition to the new requests, a total of 8 requests were carried over from 2013–14.

Of the 120 new requests for personal information, 78 requests (65%) related to subjects within the mandates of other federal institutions. These requests were redirected accordingly. Further, there was an increase over last year in the percentage of processed pages released during the reporting period. Responding to formal requests involved the review of 3,444 pages, of which 3,305 pages (96%) were released, compared with the previous year in which 88% were released.

Current and former federal public service employees were the primary requestors of information under the Privacy Act. Requests had to do with personnel or staff-relations issues that required the Secretariat’s involvement.

2.7 Other Requests

During the reporting period, the Secretariat responded to 10 consultation requests under the Privacy Act from other government organizations involving Secretariat records or issues.

As in the previous years, the ATIP Office acted as a source of expertise for Secretariat officials, providing advice and guidance on the provisions of the legislation. The ATIP Office was consulted regularly on matters relating to the disclosure and collection of data on a wide range of subjects, and provided advice to ensure transparency and compliance with the legislation. Advice and assistance were provided on surveys, various information management issues, privacy impact assessments, privacy protocols, security of information, and privacy notices for various forms and questionnaires.

Throughout the year, the ATIP Office also responded to numerous telephone calls and emails from the general public seeking guidance on how to obtain information under the Access to Information Act and the Privacy Act, and where to forward their requests. Many of these enquiries were redirected to the Royal Canadian Mounted Police, the Canada Border Services Agency, Service Canada, Citizenship and Immigration Canada, and occasionally, to provincial Freedom of Information and Privacy Offices.

2.8 Disposition of Completed Requests

In 2014–15, a total of 123 requests were completed. Table 5 provides an overview of the disposition of the completed requests.

Given that the President of the Treasury Board is responsible for ensuring compliance with the Access to Information Act and the Privacy Act government-wide, the Secretariat typically receives requests that fall within the mandates of other federal organizations. Such requests are registered, reviewed and redirected to the appropriate organizations. In the statistical report (see Appendix B, Part 2.1), these requests are included in the totals for the “no records exist” column.

2.9 Completion Time and Extensions

The legislation sets timelines for responding to privacy requests and allows for extensions when the response requires the review of a large amount of information, extensive consultations with other organizations, or extra time for translation purposes. Table 6 presents the response times for the 123 requests that the Secretariat completed in 2014–15.

The Secretariat received a large number of requests that fell within the mandates of other government organizations; these requests were completed within 1 to 15 days. Requests processed after the initial 30 days required consultations with other federal organizations.

Of the 123 completed requests, 121 (98%) were completed within the prescribed time limits, including all extensions, which were taken in accordance with sub-paragraph 15(a)(i) of the Privacy Act. Several factors continued to contribute to the Secretariat’s successful performance and on-time response rates: strong case file management, information and awareness sessions with Secretariat officials and sector contacts, and the Secretariat’s streamlined delegation orders.

For seven requests (6%), the Secretariat sought extensions to the prescribed time limits in order to consult with other government organizations.

2.10 Exemptions Invoked

The Privacy Act allows, and in certain instances, requires that some personal information, such as information related to law enforcement investigations, information about other individuals or information that is subject to solicitor-client privilege, be exempted and not released.

In 2014–15, the Secretariat invoked a total of 13 exemptions as per specific sections of the Privacy Act, as follows:

Section 26:

Exempting personal information about individuals other than the requestor (10); and

Section 27:

Exempting personal information related to solicitor-client privilege (3).

2.11 Exclusions Invoked

The Privacy Act does not apply to information that is already publicly available, such as government publications and material in libraries and museums. It also excludes material such as Cabinet confidences.

In this reporting period, the Secretariat did not invoke any exclusions.

2.12 Costs

During 2014–15, the ATIP Office incurred $114,515 in salary costs and $64,890 in administrative costs (software licences, professional services fees, office equipment and supplies, training) to ensure appropriate implementation of the Privacy Act.

These costs do not include resources expended by the Secretariat’s sectors to meet the requirements of the Act.

2.13 Education and Training

During the reporting period, the ATIP Office continued to conduct training sessions for the Secretariat’s employees on a regular basis—seven sessions were provided to 52 staff. Some of these sessions were tailored to the specific needs of divisional teams and sectors across the Secretariat. Two additional privacy policy sessions were provided to 12 employees.

2.14 Policies, Guidelines, Procedures and Initiatives

To make the process of requesting government records simpler and more convenient, on April 9, 2013, the Government of Canada launched a pilot initiative that enables Canadians to submit their ATIP requests and fees online. The participants in the pilot were Citizenship and Immigration Canada, Shared Services Canada and the Treasury Board of Canada Secretariat. The service has now been expanded to include 29 federal government institutions, making it easier to submit an access to information or privacy request across government. This initiative is part of the modernization of the administration of access to information, one of the commitments of Canada’s Action Plan on Open Government.

During the reporting period, a total of 225 (41%) of the 547 formal ATIP requests were submitted to the Secretariat’s ATIP Office using the ATIP online request service. This is an increase of three percentage points from last year when a total of 271 (37.5%) of the 722 requests were submitted using the online service.

To ensure policy compliance and adherence to procedures for appropriate handling and preparation of responses to ATIP requests, the Secretariat’s ATIP Office disseminated a variety of tools and checklists, and held face-to-face meetings to share these tools with new staff and contacts. These tools and meetings were instrumental in ensuring that the Secretariat’s employees remain aware of their roles and responsibilities related to ATIP requests.

Further, the ATIP Office continued to develop its Privacy Management Framework, which comprises the Privacy Breach procedures, the Privacy Impact Assessment procedures and the Privacy Code. These three documents will be finalized over the next reporting period.

2.15 Complaints, Investigations and Federal Court Cases

Clients of the Secretariat filed one new complaint with the Office of the Privacy Commissioner of Canada in 2014–15. The reason for the new complaint was the application of exemptions to disclosure under the Privacy Act.

During the reporting period, two complaint investigations were completed, with the following results:

• One complaint was settled during the course of the investigation.
• The second complaint was deemed to be not well-founded.

Both of these completed complaints dealt with allegations of unauthorized use and disclosure of personal information.

There were no new court cases in 2014–15. There have been no new court cases against the Secretariat in relation to the Access to Information Act and the Privacy Act in the last seven years.

2.16 Monitoring of Compliance and Requests for Corrections

The ATIP Office distributes weekly compliance statistics that are shared with the program areas and senior management for all access to information requests. Requests under the Privacy Act are not monitored; however, Privacy Impact Assessment status updates were added to the weekly report during the last quarter of this reporting period.

There were no requests for corrections of personal information over the reporting period.

2.17 Summary of Material Privacy Breaches

The Secretariat did not incur any material privacy breaches over the reporting period. However, a privacy breach did occur that did not qualify as a material privacy breach under the Directive on Privacy Practices, and it was reported to the Office of the Privacy Commissioner and the Secretariat’s Information and Privacy Policy Division.

The breach was in regard to a May 14, 2014, email that had inadvertently been sent to over 900 participants of the Canadian Open Data Experience Event, as opposed to sending a blind copy where participant emails would not be shared. Participants included students, members of the private sector and public servants. A “bcc” email quickly followed (two hours after the original email was sent) to all participants apologizing for the error. Since then, the unit has put in place written procedures outlining the measures to consider before sending a mass email.

2.18 Privacy Impact Assessments

Two Privacy Impact Assessments (PIAs) were completed during the 2014-15 reporting period.

The first PIA dealt with a government-wide employee certification program in procurement and/or materiel management. The Secretariat manages the certification program and coordinates the participation of federal departments, agencies and central agencies, professional designation–granting bodies and professional institutes. The Canadian General Standards Board at Public Works and Government Services Canada (PWGSC) administers the certification program.

A PIA was necessary because both the PWGSC and the Secretariat modified their use, collection, disclosure and retention of personal information in order to track participant progress through the program and to provide required support.

The second PIA was developed as a result of the performance and talent management program, which was launched to strengthen and standardize performance management across the core public administration for all employees below the level of Executive (who have an analogous process in place since 2007).

Employees, managers and supervisors are required to provide personal information to the Secretariat as part of the evaluation and assessment of employee performance. The personal information is to be stored in the Public Service Performance Management Application (PSPM App), which is accessed using a public key infrastructure certificate (PKI or myKEY) issued by Shared Services Canada.

A PIA was required to identify and assess any risks to privacy when employees, managers and supervisors complete the new standardized performance agreement.

Both of these PIAs included the registration of two new personal information banks, which will be reflected in the 2015 Info Source update.

2.19 Disclosures Under Paragraph 8(2)(m) of the Privacy Act

Paragraph 8(2)(m) allows for the disclosure of personal information when the public interest clearly outweighs any invasion of privacy or when the disclosure would benefit the individual involved. In the 2014–15 period, there were no disclosures pursuant to paragraph 8(2)(m) of the Privacy Act.

2.20 Privacy Impact Assessments

Info Source is a series of publications containing information about, and collected by, the Government of Canada. The primary purpose of Info Source is to assist individuals in exercising their rights under the Access to Information Act and the Privacy Act. Info Source also supports the federal government’s commitment to facilitate access to information regarding its activities.

A description of the Secretariat’s functions, programs, activities and related information holdings can be found in Treasury Board Secretariat - Sources of Federal Government and Employee Information 2014 (Info Source). Info Source also provides private individuals and federal government employees (current and former) with the information required to access their personal information held by government institutions that are subject to the Privacy Act. The Secretariat does not have any exempt personal information banks.

This year, the Secretariat’s ATIP Office assessed the 2013 and the 2014 Info Source recommendations from the Secretariat’s Information and Privacy Policy Division. The ATIP Office will be implementing some of the recommendations for the 2015 Info Source update, and has developed a three-year action plan to address identified shortcomings, such as updating the description of document types and collapsing certain redundant personal information banks, while re-registering others.

All Info Source publications are available online free of charge.

Schedule A: Sections of the Access to Information Act to Be Delegated

Schedule B: Sections of the Privacy Act to Be Delegated