Privacy Act - CRTC Annual Report - 2019-2020

Introduction

The Canadian Radio-television and Telecommunications Commission (CRTC) is pleased to present its Annual Report to Parliament, in accordance with section 72^{Footnote 1} of the Privacy Act (the Act). The report describes the activities that support compliance with the Act for the fiscal year commencing April 1, 2019 and ending March 31, 2020.

The Purpose of the Privacy Act

Section 2 of the Act sets out its purpose, which is to protect the privacy of individuals with respect to personal information about themselves held by a government institution, and to provide individuals with a right of access to that information.

It also protects against unauthorized disclosure of that personal information. In addition, it strictly controls how the government will collect, use, store, disclose, and dispose of any personal information.

CRTC Mandate and Responsibilities

The CRTC is an administrative tribunal within the Government of Canada that is responsible for regulating and supervising Canada’s communication system in the public interest.

The CRTC operates under a number of legislative authorities and Acts of Parliament. These include the following: the CRTC Act, the Bell Canada Act, the Broadcasting Act, the Telecommunications Act, Canada’s Anti-Spam Legislation and the Canada Elections Act, which includes provisions that established the Voter Contact Registry.

At the heart of our mandate is the duty to serve the public interest by putting Canadians at the centre of the communication system. To this end, our role encompasses consulting Canadians on communication issues of importance to them, dealing with the many applications we receive by making decisions and rules, responding to enquiries and complaints, as well as reporting to Canadians on the progress and outcomes of our work. The CRTC promotes and enforces compliance with its regulatory policies and decisions. It encourages and facilitates industry co-regulation and self-regulation through consultations, committees and working groups with various industry stakeholders. The CRTC also plays a key role in resolving industry disputes. Finally, in the current dynamic and evolving communication environment, the CRTC collaborates with various domestic and international stakeholders to leverage capacity and intelligence on a host of interrelated policy issues and questions.

The CRTC delivers its mandate from offices in the National Capital Region and regional offices throughout Canada.

Organizational Structure

The CRTC’s Access to Information and Privacy (ATIP) Office is located within the Information Management section of the Information Management and Information Technologies Directorate. When fully staffed, the CRTC ATIP Office has six indeterminate employees.

The activities of the ATIP Office include:

• publishing all proactive disclosure;
• receiving and processing requests in accordance with the Act;
• promoting awareness of the Actwithin the Commission;
• preparing the annual reports to Parliament, the annual statistical report and maintaining the Department’s Info Source chapter;
• monitoring Commission compliance with the Act; and
• providing professional advice and guidance to senior management and all Commission staff on the Act.

The ATIP Office uses the AccessPro Case Management system and an imaging and electronic redaction software solution, AccessPro Redaction. The Office works closely with 14 departmental ATIP liaison officers who are appointed by the sectors. The liaison officers are responsible for ensuring that requests tasked to their groups are handled promptly and that relevant records are forwarded to the ATIP Office on time.

In 2019-2020, the CRTC has not entered into any service agreements pursuant to section 73.1 of the
Privacy Act.

Delegation Order

Decision-making responsibility for the application of the various provisions of the Acthas been formally established and is outlined in the Delegation Order approved by the Chairperson and CEO of the CRTC on July 30, 2020. A copy of the Delegation Order is in Appendix A of this Report.

Performance 2019-2020

Section 1: Requests under the Privacy Act

The CRTC received 11 new requests in the reporting period, which represents a 266% increase compared to the previous year where three requests were received.

Section 2: Requests Closed During the Reporting Period

2.1 Disposition and completion time

Of the 11 requests received and one carried over from the previous year, three were closed within 15 days, six were closed between 16 and 30 days, and three were closed between 31 and 60 days. In 2018-2019, of the three requests received two were closed within 15 days and since the third request was received a few days prior to the end of the reporting period, it was carried over to the next reporting period.

Of the 12 requests closed, one was fully disclosed, five were disclosed in part, four had no responsive records, and two were abandoned by applicants. In 2018-2019, no responsive records were found for either of the closed requests.

2.2 Exemptions

Sections 18 through 28 of the Actset out the exemptions that can be applied to protect information pertaining to a particular public or private interest. The CRTC used two exemptions within the five files; section 26, which protects information about another individual and section 27, which protects information that is protected under solicitor client privilege.

2.3 Exclusions

As in the previous year, no exclusions were used by the CRTC in response to the requests.

2.4 Format of information released

One file was released in paper format, and five files were released in electronic format. In 2018-2019, no format was used as there were no records for either request.

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

6,099 pages were processed and 1,814 pages were released. In 2018-2019, no pages were processed or disclosed.

2.5.2 Relevant pages processed and disclosed by size of requests

The CRTC closed 12 files. Eight files had records with an average page count of 787 pages. In 2018-2019, no records were produced in response to the requests, therefore there is no average page count for the reporting period.

2.5.3 Other complexities

Five of the requests contained interwoven information, meaning that the records contained the personal information of more than one individual. Legal advice was sought for one file that was abandoned by the applicant. In 2018-2019, there were no records for the two requests closed during the reporting period, therefore had no complexities to report.

2.6 Closed requests

During the reporting period, all 12 requests were closed within their legislative timelines.

2.7 Deemed refusals

2.7.1 Reasons for not meeting legislative timelines

Like the previous year, all requests were completed within the legislative timelines.

2.8 Requests for translation

There were no requests for translation in the reporting period.

Section 3: Disclosures under Subsections 8(2) and 8(5)

Subsection 8(2) of the Act states that subject to any other Act of Parliament, personal information under the control of a government institution may be disclosed if it meets the conditions listed in paragraphs (a) to (m).

In addition, as written in subsection 8(5), the government institution shall notify the Privacy Commissioner in writing of any disclosure of personal information under paragraph (2)(m) prior to the disclosure. There were no disclosures under section 8(2)(m).

In the course of this reporting period, the CRTC received no request where the records were released pursuant to subsections 8(2) and 8(5) of the Act.

Section 4: Requests for Correction of Personal Information and Notation

In 2019-2020, one request for correction of personal information was received and processed within the reporting period.

Section 5: Extensions

5.1 Reasons for extensions and disposition of requests

The Act allows departments to extend the legislated deadline of a request if it cannot be completed within the legislated 30-day time limit. Section 15 of the Act permits extensions if:

• meeting the original time limit would unreasonably interfere with the operations of the government institution;
• consultations, including for Cabinet Confidences, are necessary to comply with the request and cannot reasonably be completed within the original time limit; or
• additional time is necessary for translation purposes or for the purpose of converting the personal information into an alternative format.

Among the 11 requests received and 1 carried over from previous reporting period at the CRTC for personal information, 2 extensions were taken.

5.2 Length of extensions

An extension of 30 days was taken for both files.

Section 6: Consultations Received from Other Institutions and Organizations

Two consultations from another Government of Canada institution were received and processed, though no consultations from other organizations were received during the reporting period.

Section 7: Completion Time of Consultations on Cabinet Confidences

7.1 Requests with Legal Services

No requests related to Cabinet Confidences were sent to Legal Services during the reporting period.

7.2 Requests with Privy Council Office

No requests related to Cabinet Confidences were sent to the Privy Council Office during this reporting period.

Section 8: Complaints and Investigations

In 2019-2020, one new complaint was received (section 31), and one was outstanding from previous fiscal years. The Office of the Privacy Commissioner of Canada (OPC) provided the ATIP Office with a report of findings for both complaints which were determined to be not well-founded. There are no outstanding privacy complaints.

Section 9: Privacy Impact Assessments

Two Privacy Impact Assessments (PIAs) were carried over from a previous reporting period, the ATIP Office anticipates having them registered with the Treasury Board of Canada Secretariat (TBS) in the coming months, and a copy will also be provided to the OPC for their comments. One of the PIAs relates to the National Do Not Call List^{Footnote 2} and the other relates to the internal Talent Management Program.

In addition, a Preliminary Privacy Impact Assessment (PPIA) was conducted to determine if a full PIA was required prior to launching a Video Relay Service Research Project. The PPIA covered much of the same content as a core PIA, though at a different level of detail. The conclusion of the PPIA determined that a core PIA was not necessary prior to launching the Survey.

Section 10: Resources Related to the Privacy Act

When at full strength, the CRTC ATIP Office is resourced with six indeterminate employees, three of whom are devoted part-time to activities related to the Act. This equated to 0.83 FTE devoted to administering the Act. During 2019-2020, the ATIP Office incurred an estimated $63,646 in salary costs to administer the Act. These costs do not include the resources expended by the program areas of the CRTC to meet the requirements of the Act.

Due to the COVID-19 pandemic, new workplace measures and processes were put in place mid-March 2020. Prior to COVID-10 the CRTC had started the process of receiving all responsive records electronically in the ATIP Office, however, not all sectors had been doing so by mid-March. These new workplace measures allowed ATIP staff to train and coach the sectors as they adapted to this new process. This in turn caused some delays in the retrieval of records and the processing of requests. The effects will be more greatly felt in the subsequent reporting period.

Training

Over the course of the 2019-2020 fiscal year, several training sessions were offered to CRTC employees and management. The ATIP Office held 11 sessions, three in French and eight in English. 63 of the 450 CRTC employees attended the sessions, which represents 14% of staff. The ATIP Office continues to promote the roles and responsibilities of all CRTC staff related to the Act and is continuously meeting with individuals to provide one-on-one support.

The CRTC intranet, which is accessible to all employees, includes a section that describes the ATIP Office’s roles and responsibilities and provides information on the Act and related Commission policies and procedures. The ATIP Office is constantly looking for new methods to increase awareness throughout the Commission and is working on an initiative to include items in the CRTC Weekly News distributed to all employees.

Institution Specific Policies, Guidelines and Procedures

The ATIP Office met its reporting obligations for the reporting period by providing timely input to Info Source and the publication of the annual reports. The statistical report on the Act was provided to the Treasury Board Secretariat. Internally, the ATIP Office monitored the time to process requests on a daily basis with the ATIP case management system. A Privacy policy framework is being implemented, as well as more privacy awareness initiatives for employees.

The ATIP Office has also prepared its own internal administrative manual to ensure consistency among team members and to be able assist new ATIP analysts.

Complaints

In 2019-2020, one complaint was received. The ATIP Office worked with the OPC and the complaint was resolved as was the outstanding complaint from a previous year. The Commission is committed to protecting individuals’ personal information.

Monitoring of Processing Time

The CRTC is committed to responding to every Privacy request completely and in a timely matter. Therefore, the ATIP Office meets as a group weekly to review priorities and any potential issues. In addition, the ATIP Coordinator meets weekly with each analyst to review on-time performance and with the Office of the Secretary General to provide a briefing on the status of the open files. In turn, the Office of the Secretary General any concerns at the Senior Management meetings. This committee includes the Deputy Head and all of the sector heads that report directly to him.

Privacy Breaches

The CRTC did not incur any material privacy breaches over the reporting period. As for the outstanding breach from 2018-2019, the ATIP Office concluded that it was not a material breach and there was no need to send a report to the OPC.

Privacy Impact Assessments (PIA)

There were no PIA’s completed in the 2019-2020 reporting period.

Two PIAs were carried over from a previous reporting period, and both will be sent to Treasury Board of Canada Secretariat (TBS) in the coming months to be registered. A copy will also be sent to the OPC for their review and comments. One of the PIAs relates to the National Do Not Call List^{Footnote 3} and the other relates to the internal Talent Management Program.

The National Do Not Call List PIA was prepared by a consultant and is currently being reviewed by the ATIP Office.

The Talent Management Program PIA was requested by the Human Resources sector (HR) for the purpose of evaluating their new program form. The ATIP Office is currently reviewing HR’s submission.

In addition, a Preliminary Privacy Impact Assessment (PPIA) was conducted to determine if a full PIA was required prior to launching a Video Relay Service Research Project. The PPIA covered much of the same content as a core PIA, though at a different level of detail. The conclusion of the PPIA determined that a core PIA was not necessary prior to launching the service.

Public Interest Disclosures

Paragraph 8(2)(m) of the Act allows the head of the institution to disclose personal information without the consent of the affected individual in cases where, in the opinion of the head, the public interest outweighs any invasion of privacy that could result from the disclosure or when it is clearly in the best interest of the individual to disclose.

During the reporting period, CRTC made no disclosure of personal information under this provision.

Appendix A: Delegation Order

Privacy Act Delegation Order

I, the undersigned, Chairperson and Chief Executive Officer of the Canadian Radio-Television and Telecommunications Commission (CRTC), pursuant to section 73 (1)of the Privacy Act*, hereby designate the person or persons holding the position or positions set out in the schedule hereto to exercise and perform the powers, duties and functions of the Chairperson and Chief Executive Officer, as the head of the government institution, under the sections of the Act set out in the attached schedule for each position.

As well, the designation of all powers, duties and functions under the Privacy Act prior to June 21, 2019 remain in effect.

This Delegation Order supersedes all previous Delegation Orders with respect to the CRTC, or any portion thereof.

*R.S.C. 1985, Ch. P-21

Appendix B: Statistical Report

Appendix C: New Exemptions Table

New Exemptions Tables