2017-2018 Annual Report on the Administration of the Privacy Act

Table of contents

Introduction

The Privacy Act (Act), proclaimed in 1983, protects the privacy of individuals who are Canadian citizens or permanent residents with respect to personal information about themselves held by the Canadian government. The Act provides individuals with the right to access their personal information and protects the privacy of individuals by prescribing the manner in which the government may collect, use, disclose, retain and dispose of personal information. Individuals may also request correction of personal information where they perceive inaccuracies or omissions and may have notations attached to the information where corrections are refused.

Section 72 of the Act requires that the head of every government institution prepare for submission to Parliament an annual report on the administration of the Act within the institution during each financial year.

This report covers the period from April 1, 2017 to March 31, 2018.

About the Canadian Transportation Agency

The Canadian Transportation Agency (CTA) is an independent, quasi-judicial tribunal and regulator that has, with respect to all matters necessary for the exercise of its jurisdiction, all the powers of a superior court.

The CTA oversees the very large and complex Canadian transportation system, which is essential to the economic and social well-being of Canadians.

The CTA's decision-makers are regular Members appointed by the Governor-in-Council (GIC) and temporary Members appointed by the Minister of Transport from a GIC-approved roster. Members' key functions include making adjudicative rulings, regulations, and regulatory determinations, as well as designating CTA staff to exercise the role of enforcement officers.

The CTA has three core mandates:

  • to help ensure that the national transportation system runs efficiently and smoothly in the interests of all Canadians: those who work and invest in it; the producers, shippers, travellers and businesses who rely on it; and the communities where it operates.
  • to protect the human right of persons with disabilities to an accessible transportation network.
  • to provide consumer protection for air passengers.

To help advance these mandates, the CTA has three tools at its disposal:

  • Rule-making: The CTA develops and applies ground rules that establish the rights and responsibilities of transportation service providers and users and that level the playing field among competitors. These rules can take the form of binding regulations or less formal guidelines, codes of practice or interpretation notes.
  • Dispute resolution: The CTA resolves disputes that arise between transportation service providers on the one hand, and their clients and neighbours on the other, using a range of tools from facilitation and mediation to arbitration and adjudication.
  • Information provision: The CTA provides information on the transportation system, the rights and responsibilities of transportation service providers and users, and the CTA's legislation and services.

Organizational Structure of the ATIP Office

During this reporting period, the Access to Information and Privacy (ATIP) Office was positioned in the Information Management and Technology Services Directorate (IMTSD). The Office is comprised of one ATIP Coordinator reporting to the Director of IMTSD.

The ATIP Coordinator is responsible for the daily activities related to the administration of the Access to Information Act (ATIA) and Privacy Act and ensuring compliance with the requirements of the Acts, the policies and directives, and any other ATIP policy instrument issued by the Treasury Board of Canada Secretariat.

Some of the activities of the ATIP Office include:

  • processing requests for information submitted under the ATIA and requests for personal information pursuant to the Act;
  • responding to consultation requests received from other government institutions;
  • providing advice and guidance to requesters and promoting awareness to CTA employees;
  • updating, developing and implementing CTA procedures and practices for the application of the Acts;
  • collaborating with the Office of the Information Commissioner and with the Office of the Privacy Commissioner on the resolution of complaints;
  • preparing statistical reports and annual reports to Parliament on the administration of the Acts.

Open Court Principle

In its role as a quasi-judicial tribunal, the CTA operates like a court when adjudicating disputes and is therefore bound by the open court principle. This means that the CTA's adjudicating proceedings must be open and accessible to all Canadians.

Any submissions or documents filed with the CTA as part of its formal adjudication process are made part of the public record without redaction, unless a claim for confidentiality has been made to and accepted by the CTA. Requests for information related to adjudication decisions are processed informally, and records are released in their entirety unless a claim for confidentiality was made.

While requests for information on the public record are processed informally by other areas of the CTA, the ATIP Office must also apply the open court principle when these records form part of a response to a request made under the Act.

Delegation Order

Delegation orders set out what the powers, duties and functions for the administration of the Act that have been delegated by the head of the institution, and to whom.

In May 2016, the Chairman and Chief Executive Officer as head of the CTA delegated full authority to the Director of IMTSD and the Chief Corporate Officer as well as a partial authority to the ATIP Coordinator.

A copy of the signed delegation instrument is included in Appendix B.

Highlights of the Statistical Report, 2017-2018

All formal requests made under the Act received during this reporting year met their legislative deadline.

Requests received under the Act, Consultations and Informal requests

During the reporting period, the CTA received three new requests under the Act. This represents a decrease of three requests (50%) over the previous year. The CTA also had one outstanding request from the previous reporting period resulting in four active requests. All four requests were completed during the 2017-2018 reporting year. No requests for consultation was received and no informal requests were processed within the ATIP Office.

Overview of requests received and completed in the ATIP Office over the last four years

Reporting Year Requests Received Requests Completed*
2017-2018 3 4
2016-2017 6 5
2015-2016 1 1
2014-2015 1 1
*includes requests outstanding from the previous reporting year

Disposition of Completed Requests

With respect to the disposition, all four requests were disclosed in part to the requester.

Completion Time and Extensions on Completed Requests

Of the 4 requests completed in the reporting period, one request (25%) was completed in 30 days or less and three requests (75%) were completed within 60 days.

The Act allows institutions to extend the time limit for processing a request for a maximum of 30 days, if:

  • meeting the original time limit would unreasonably interfere with the operations of the government institution, or
  • consultations are necessary to comply with the request that cannot reasonably be completed within the original time limit

It may also extend the time limit for a period of time as is reasonable, if additional time is necessary for translation purposes or for the purposes of converting the personal information into an alternative format.

Three extensions were taken during the reporting year, as meeting the original time limit would have unreasonably interfered with the operations of the CTA.

Exemptions and Exclusions

Exemptions and exclusions are the only grounds to withhold information found in records that are requested under the Act and their application is limited and specific. Section 26 which protects personal information pertaining to individuals other than the requester, was invoked on 4 requests and remains to be the most used section in the past four years.

The Act indicates that certain types of materials are excluded from its application, specifically, records that are already available to the public (section 68) and Cabinet Confidences (section 69). The CTA did not invoke exclusions on any requests completed during the reporting period.

CTA's statistical report on the Privacy Act for reporting year 2017-2018 is provided in Appendix A.

Training

During the reporting period, the ATIP Office provided guidance to management and employees regarding the requirements of the Act through ongoing dialogue and informal discussions.

Policies, Guidelines, Procedures and Initiatives

Efforts were made during the reporting period to review and update employee access to the Records, Document and Information Management System (RDIMS) and the ATIP Office's Access Pro Case Management (APCM) system to ensure access to personal information is on a need to know basis only.

Summary of Key Issues and Actions Taken on Complaints or Audits

The Office of the Privacy Commissioner (OPC) notified the CTA of one new complaint during the 2017-2018 reporting period. The individual alleges that the CTA contravened the access provisions of the Act, by inappropriately invoking exemptions. The investigation is ongoing.

One other complaint was received by the OPC during the 2017-2018 reporting period where the individual alleges that the CTA contravened the use and disclosure provisions of the Act when it disclosed a personal e-mail address in the c.c. field of its e-mails to over 100 applicants involved in the adjudication of a dispute with an airline. The complainant is of the view that such a practice has highly negative impacts on the privacy of individuals and the security of their individual data systems, and creates a potential financial hardship for them. All information in response to the complaint, including explanations as to why personal information may be shared amongst applicants during an adjudication proceeding, was provided to the OPC in April 2015. Further to this, the OPC was advised in June 2015 of the Federal Court of Appeal Decision No. 2015-FCA-140, requiring the CTA to provide public access to all information on the public record, including what would otherwise be considered personal information. The complaint remains open until further notice from the OPC.

Monitoring Compliance

During the reporting period, the CTA continued to use Access Pro Case Management (APCM) system to track and monitor all administrative activities and set due dates in order to meet statutory timelines. Due dates for all actions were communicated to staff and reminders sent as required. All actions were also detailed in a separate tracking tool and the status of each request continues to be communicated to the Chief Corporate Officer and the Director of IMTSD on a weekly basis.

There were no requests for corrections of personal information over the reporting year.

Material Privacy Breaches

No material privacy breaches were identified during the reporting period.

Privacy Impact Assessments

The CTA did not complete any Privacy Impact Assessments in 2017-2018.

Public Interest Disclosures

During the reporting period, the CTA did not disclose information pursuant to paragraph 8(2)(m) of the Act.

Appendix A: Statistical Report on the Privacy Act

Reporting Period: April 1, 2017 to March 31, 2018

Part 1: Requests Under the Privacy Act

  Number of Requests
Received during reporting period 3
Outstanding from previous reporting period 1
Total 4
Closed during reporting period 4
Carried over to next reporting period 0

Part 2: Requests Closed During the Reporting Period

2.1 Disposition and completion time

Disposition of Requests Completion Time
1 to 15 Days 16 to 30 Days 31 to 60 Days 61 to 120 Days 121 to 180 Days 181 to 365 Days More Than 365 Days Total
All disclosed 0 0 0 0 0 0 0 0
Disclosed in part 0 1 3 0 0 0 0 4
All exempted 0 1 0 0 0 0 0 1
All excluded 0 0 0 0 0 0 0 0
No records exist 0 0 0 0 0 0 0 0
Request abandoned 0 0 0 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0 0 0 0
Total 0 1 3 0 0 0 0 4

2.2 Exemptions

Section Number of Requests
18(2) 0
19(1)a) 0
19(1)b) 0
19(1)c) 0
19(1)d) 0
19(1)e) 0
19(1)f) 0
20 0
21 0
22(1)a)(i) 0
22(1)a)(ii) 0
22(1)a)(iii) 0
22(1)b) 0
22(1)c) 0
22(2) 0
22.1 0
22.2 0
22.3 0
23a) 0
23b) 0
24a) 0
24b) 0
25 0
26 4
27 0
28 0

2.3 Exclusions

Section Number of Requests
69(1)a) 0
69(1)b) 0
69.1 0
70(1) 0
70(1)a) 0
70(1)b) 0
70(1)c) 0
70(1)d) 0
70(1)e) 0
70(1)f) 0
70.1 0

2.4 Format of information released

Paper Papier Electronic Other formats
All disclosed 0 0 0
Disclosed in part 1 3 0
Total 1 3 0

2.5 Complexity

2.5.1 Relevant pages processed and disclosed
Disposition of Requests Number of Pages Processed Number of Pages Disclosed Number of Requests
All disclosed 0 0 0
Disclosed in part 1293 599 4
All exempted 0 0 0
All excluded 0 0 0
Request abandoned 0 0 0
Neither confirmed nor denied 0 0 0
Total 1293 599 4
2.5.2 Relevant pages processed and disclosed by size of requests
Disposition Less Than 100 Pages Processed 101-500 Pages Processed 501-1000 Pages Processed 1001-5000 Pages Processed More Than 5000 Pages Processed
Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed
All disclosed 0 0 0 0 0 0 0 0 0 0
Disclosed in part 1 53 2 381 1 165 0 0 0 0
All exempted 0 0 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0 0 0
Request abandoned 0 0 0 0 0 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0 0 0 0 0 0
Total 1 53 2 381 1 165 0 0 0 0
2.5.3 Other complexities
Disposition Consultation Required Legal Advice Sought Interwoven Information Other Total
All disclosed 0 0 0 0 0
Disclosed in part 0 1 0 0 1
All exempted 0 0 0 0 0
All excluded 0 0 0 0 0
Request abandoned 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0
Total 0 1 0 0 1

2.6 Deemed refusals

2.6.1 Reasons for not meeting statutory deadline
Number of Requests Closed Past the Statutory Deadline Principal Reason
Workload External Consultation Internal Consultation Other
0 0 0 0 0
2.6.2 Number of days past deadline
Number of Days Past Deadline Number of Requests Past Deadline Where No Extension Was Taken Number of Requests Past Deadline Where An Extension Was Taken Total
1 to 15 days 0 0 0
16 to 30 days 0 0 0
31 to 60 days 0 0 0
61 to 120 days 0 0 0
121 to 180 days 0 0 0
181 to 365 days 0 0 0
More than 365 days 0 0 0
Total 0 0 0

2.7 Requests for translation

Translation Requests Accepted Refused Total
English to French 0 0 0
French to English 0 0 0
Total 0 0 0

Part 3: Disclosures Under Subsections 8(2) and 8(5)

Paragraph 8(2)e) Paragraph 8(2)m) Subsection 8(5) Total
0 0 0 0

Part 4: Requests for Correction of Personal Information and Notations

Disposition for Correction Requests Received Number
Notations attached 0
Requests for correction accepted 0
Total 0

Part 5: Extensions

5.1 Reasons for extensions and disposition of requests

Disposition of Requests Where an Extension Was Taken 15a)(i) Interference With Operations 15a)(ii) Consultation 15b) Translation or Conversion
Section 70 Other
All disclosed 0 0 0 0
Disclosed in part 3 0 0 0
All exempted 0 0 0 0
All excluded 0 0 0 0
No records exist 0 0 0 0
Request abandoned 0 0 0 0
Total 3 0 0 0

5.2 Length of extensions

Length of Extensions 15a)(i) Interference with operations 15a)(ii) Consultation 15b) Translation purposes
Section 70 Other
1 to 15 days 2 0 0 0
16 to 30 days 1 0 0 0
Total 3 0 0 0

Part 6: Consultations Received From Other Institutions and Organizations

6.1 Consultations received from other Government of Canada institutions and other organizations

Consultations Other Government of Canada Institutions Number of Pages to Review Other Organizations Number of Pages to Review
Received during the reporting period 0 0 0 0
Outstanding from the previous reporting period 0 0 0 0
Total 0 0 0 0
Closed during the reporting period 0 0 0 0
Pending at the end of the reporting period 0 0 0 0

6.2 Recommendations and completion time for consultations received from other Government of Canada institutions

Recommendation Number of Days Required to Complete Consultation Requests
1 to 15 Days 16 to 30 Days 31 to 60 Days 61 to 120 Days 121 to 180 Days 181 to 365 Days More Than 365 Days Total
All disclosed 0 0 0 0 0 0 0 0
Disclosed in part 0 0 0 0 0 0 0 0
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
Consult other institution 0 0 0 0 0 0 0 0
Other 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0

6.3 Recommendations and completion time for consultations received from other organizations

Recommendation Number of days required to complete consultation requests
1 to 15 Days 16 to 30 Days 31 to 60 Days 61 to 120 Days 121 to 180 Days 181 to 365 Days More Than 365 Days Total
All disclosed 0 0 0 0 0 0 0 0
Disclosed in part 0 0 0 0 0 0 0 0
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
Consult other institution 0 0 0 0 0 0 0 0
Other 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0

Part 7: Completion Time of Consultations on Cabinet Confidences

7.1 Requests with Legal Services

Number of Days Fewer Than 100 Pages Processed 101-500 Pages Processed 501-1000 Pages Processed 1001-5000 Pages Processed More than 5000 Pages Processed
Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed
1 to 15 0 0 0 0 0 0 0 0 0 0
16 to 30 0 0 0 0 0 0 0 0 0 0
31 to 60 0 0 0 0 0 0 0 0 0 0
61 to 120 0 0 0 0 0 0 0 0 0 0
121 to 180 0 0 0 0 0 0 0 0 0 0
181 to 365 0 0 0 0 0 0 0 0 0 0
More than 365 days 0 0 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0 0 0

7.2 Requests with Privy Council Office

Number of Days Fewer Than 100 Pages Processed 101-500 Pages Processed 501-1000 Pages Processed 1001-5000 Pages Processed More than 5000 Pages Processed
Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed
1 to 15 0 0 0 0 0 0 0 0 0 0
16 to 30 0 0 0 0 0 0 0 0 0 0
31 to 60 0 0 0 0 0 0 0 0 0 0
61 to 120 0 0 0 0 0 0 0 0 0 0
121 to 180 0 0 0 0 0 0 0 0 0 0
181 to 365 0 0 0 0 0 0 0 0 0 0
More than 365 days 0 0 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0 0 0

Part 8: Complaints and Investigations Notices Received

Section 31 Section 33 Section 35 Court action Total
0 0 0 0 0

Part 9: Privacy Impact Assessments (PIAs)

Number of PIA(s) completed 0

Part 10: Resources Related to the Privacy Act

10.1 Costs

Expenditures Amount
Salaries $31,853
Overtime $0
Goods and Services $3,307
Professional services contracts $0  
Other $3,307
Total $35,160

10.2 Human Resources

Resources Person Years Dedicated to Privacy Activities
Full-time employees 0.37
Part-time and casual employees 0.25
Regional staff 0.00
Consultants and agency personnel 0.00
Students 0.00
Total 0.62

Appendix B: May 2016 Delegation Order

The Chairman and Chief Executive Officer of the Canadian Transportation Agency, pursuant to section 73 of the Access to Information Act and section 73 of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Chairman and Chief Executive Officer as the head of Canadian Transportation Agency, under the provisions of the Acts and regulations set out in the Schedule opposite each position. This designation replaces all previous delegation orders.

Original signed by

Scott Streiner

The Chairman and Chief Executive Officer

2016-05-02

Section of the Privacy Act Description Authority Delegated to
Administration of the Privacy Act Chief Corporate Officer Director IMTSD ATIP Coordinator ATIP Analyst
8(2)(j)(m) Disclosure of personal information
  • authorize the disclosure of personal information for research purposes and in the public interest or the interest of the individual
 X X    
8(4) Requests from investigative bodies
  • retain a copy of the requests and the disclosed records
 X X    
8(5) Notify Privacy Commissioner of 8(2)(m) disclosures
  • notify Commissioner of public interest disclosures and disclosure which would clearly benefit individuals to whom the information relates
 X X X  
9(1) Retain record of disclosures
  • retain a record of use or disclosure of personal information where the use or disclosure is not included in InfoSource, and attach the record to the personal information
 X X X  
9(4) Notify Privacy Commissioner of consistent use
  • notify Commissioner of consistent use or disclosure where the use or disclosure is not included in InfoSource and update in next publication
 X X X  
10 Include personal information in Personal Information Banks
  • include all personal information under the control of the CTA in Personal Information Banks
 X X X  
14(a) Notice where access requested
  • give written notice to individuals, as to whether or not access to the records will be given and provide access if access is to be given
 X X X X
14(b) Giving access to the record X X X  
15 Extension of time limits
  • extend time limits for responding to requests for access
 X X X X
17(2)(b) Language of access
  • decide whether to translate information
 X X X  
17(3)(b) Access in an alternative format
  • determine if the giving of access in an alternative format to a person with a sensory disability is necessary and reasonable
 X X X  
Exemption Provisions of the Privacy Act
18(2) Exempt banks
  • Refuse to disclose information contained in an exempt bank
 X X X  
19(1)(2) Personal information obtained in confidence X X X  
20 Federal-provincial affairs X X    
21 International affairs and defence X X    
22 Law enforcement and investigation X X    
23 Information prepared by an investigative body for security clearances X X    
24 Information collected by the Canadian Penitentiary Services, National Parole Services or National Parole Board X X    
25 Safety of individuals X X    
26 Personal information about other individuals X X X  
27 Solicitor-client privilege X X    
28 Medical records X X    
31 Receive notice of investigations
  • receive notice of investigations by the Privacy Commissioner
 X X X  
33(2) Right to make representations
  • make representations to the Privacy Commissioner during investigation
 X X X  
35(1) Privacy Commissioner's Report
  • receive Commissioner's report of findings, give notice of action taken
 X X X  
35(4) Access to be given to complainant
  • give complainant access to information after 35(1)(b) notice
 X X X  
36(3) Review of exempt banks
  • receive Commissioner's findings of investigation of exempt bank
 X X X  
37(3) Compliance investigation
  • receive report of Privacy Commissioner's findings after compliance investigations of sections 4 to 8
 X X X  
51(2)(b) Special rules for hearings
  • request that section 51 hearings be held in NCR
 X X X  
51(3) Representations in hearings
  • request and be given right to make representations in section 51 hearings
 X X X  
70 Cabinet Confidences X X    
72(1) Annual Report
  • submit Annual Report to Parliament
 X X X  
Responsibilities Privacy Regulations:
9 Provide reasonable facilities and time for examination of information X X X  
11(2) Upon receipt of Correction Request Form, provide notification to individual that correction has been made and provide notifications in 11(2)(b) and (c) X X X  
11(4) Where a request for correction is refused, attach notification to the personal information that a correction was refused and provide notifications in 11(4)(b)(c) and (d) X X X  
13(1) Authorize the disclosure of medical records to a qualified medical practitioner or psychologist for opinion as to whether disclosure would be contrary to the best interests of the individual X X    
14 Examination in presence of medical practitioner of psychologist X X X  

Publication information

Date modified: