2022 to 2023 Annual Report on the Privacy Act

ISSN: 2818-8152

On this page

• 1. Introduction
• 2. Organizational structure
• 3. Performance 2022 to 2023
• 4. Training and awareness
• 5. Policies, guidelines and procedures
• 6. Initiatives and projects to improve privacy
• 7. Summary of key issues and actions taken on complaints
• 8. Material privacy breaches
• 9. Privacy impact assessments
• 10. Public interest disclosures
• 11. Monitoring compliance
  • Appendix A: Statistical report on the Privacy Act
  • Appendix B: Supplemental statistical report on the Access to Information Act and the Privacy Act
  • Appendix C: Delegation order

1. Introduction

The Privacy Act (hereafter referred to as the act) gives individuals the right to access their own personal information held by the Government of Canada. The act also protects the privacy of individuals by respecting parameters relating to the collection, use, disclosure, retention, and disposal of personal information held by federal government institutions.

In accordance with section 72 of the act, the head of every Government institution prepares an annual report on the administration of the act within that institution. This report describes how the Canadian Food Inspection Agency (CFIA) administered the act for fiscal year 2022 to 2023.

As part of its commitment to openness and transparency, the CFIA recognizes the right to access information in government records and makes every reasonable effort to assist those that request access to their personal information.

About the Canadian Food Inspection Agency

CFIA employees are dedicated to safeguarding food safety, as well as animal and plant health, to enhance Canada's environment, economy, and the health and well-being of all Canadians. The agency is one of Canada's largest science-based, regulatory departments/agencies. The CFIA is led by its President, who reports to the Minister of Health, and its employees work across 5 operational regions: Atlantic; Quebec; the National Capital Region; Ontario; and the West.

The CFIA develops program requirements and delivers inspection and other services to:

• prevent and manage food safety risks
• protect plant resources from pests, diseases, and invasive species
• prevent and manage animal and zoonotic diseases
• contribute to consumer protection
• contribute to market access for Canada's food, plants, animals, and their products

The CFIA bases its activities on science, effective risk management, commitment to service and efficiency, and collaboration with domestic and international organizations that share its objectives.

The CFIA is responsible for administering and enforcing 11 federal statutes, one fee notice, and 22 regulations that govern the safety and labelling of food sold in Canada and support a sustainable plant and animal resource base.

The CFIA shares many areas of responsibility with other federal departments and agencies, provincial, territorial and municipal authorities, and other stakeholders. Within this complex operating environment, the CFIA works with its partners to implement food safety measures, manage food, animal and plant risks and emergencies, and promote the development of food safety and disease control systems to maintain the safety of Canada's high-quality agriculture, agri-food, aquaculture, and fishery, and their related products.

The CFIA's activities include:

• verifying the compliance of imported products
• registering and inspecting establishments
• testing food, animals and plants, and their related products
• approving the use of many agricultural inputs

The CFIA also provides scientific advice, develops new technologies, provides testing services, and conducts regulatory research. Its responsibilities and strategic outcomes are illustrated in the Departmental Results Framework, which reflects how the CFIA allocates and manages its resources to achieve the corresponding expected results.

2. Organizational structure

Administration of the act

Administration of the act within the CFIA is the primary responsibility of the Access to Information and Privacy (ATIP) office, which is part of the agency's Communications and Public Affairs Branch. The ATIP office processes all requests for personal information and coordinates all activities related to the act, associated regulations, directives and guidelines. The CFIA was not party to any agreements under section 73.1 of the act during this reporting period.

Resources

The ATIP office is headed by a director who reports to the Executive Director, Communications Services and Strategic Planning. During the reporting period, there were 15.170 full-time or part-time equivalents and 2.107 persons (contracted consultants) dedicated to the ATIP office. In addition to the ATIP office resources, there are also dedicated ATIP advisor positions in the core branches who report on branch-related ATIP issues and activities. These branch advisors work with the ATIP office to ensure an efficient and effective process to respond to applicants in a timely manner.

An estimated $256,062 in salary costs and $95,120 in operating costs were incurred by the ATIP office to administer the Privacy Act for the reporting period. These costs do not include resources within each branch (such as the branch ATIP advisors), or any other expenditures incurred by the branches and program areas to meet the requirements of the act.

3. Performance 2022 to 2023

The CFIA received 47 new privacy requests under the Privacy Act between April 1, 2022 and March 31, 2023. This represents an increase of 57% from the previous reporting period. There were 12 outstanding requests from the previous year, increasing the total to 59 requests that required processing. A total of 57 requests were completed during the reporting period leaving a total of 2 to be carried forward in fiscal year 2023 to 2024. These 57 completed requests represented a total of 41,074 pages that were reviewed and 12,218 that were released pursuant to the act.

Throughout the reporting period, the ATIP office maintained a service standard of 77% of the requests closed within legislated timelines. This represents a decrease of 4% from fiscal year 2021 to 2022 and is largely attributed to the volume of records that required processing. In addition, the ATIP office was challenged at times to prioritize specialized privacy services and advice to internal clients working on national programs. An example of this was the need to consult, research and advise regarding the sharing of information pertaining to infected premises for both potato wart and avian influenza.

The ATIP office was not impacted by any COVID-19-related measures during the reporting period.

The following table outlines the cycle of privacy requests at CFIA for the last 5 fiscal years (FY):

As of March 31, 2023, the CFIA had 2 active requests under the act, both received in 2022 to 2023 and both of which were still within legislated timelines. In addition, the CFIA had 6 active complaints, 5 of which were received in 2022 to 2023 and 1 was received in 2021 to 2022.

Consultations

There were no consultations received from other institutions during the reporting period.

Completion times

The 57 requests completed in 2022 to 2023 were processed in the following timeframes:

• 40 within 30 days or less (70%)
• 5 within 31 to 60 days (9%)
• 6 within 61 to 120 days (10%)
• 4 within 121 to 180 days (7%)
• 1 within 181 to 365 days (2%)
• 1 over 365 days (2%)

Information relating to the performance of responding to requests is reported on a quarterly basis to CFIA's senior management cadre.

Disposition of completed requests

The disposition of the 57 completed requests consisted of releases broken down as follows:

• 7 were fully disclosed (12%)
• 24 were partially disclosed (42%)
• 5 consisted of a request where no records existed (9%)
• 21 were abandoned (37%)

All requesters received copies of the requested information as opposed to reviewing the information on site.

Extensions

It was necessary to extend the 30 calendar day time limit for 15 requests. All extensions taken were under 15(a)(i), interference with operations. 13 were for requests with a large volume of pages, 1 was for documents which were difficult to obtain, and 1 was for further review to determine exemptions.

4. Training and awareness

The ATIP office delivered 16 virtual training sessions to 94 employees during fiscal year 2022 to 2023. The purpose of these training sessions ranged from 4 sessions to increase awareness of the act, clarify requirements under the act and highlight processes that facilitate the CFIA in meeting its obligations; 4 sessions providing a comprehensive introductory course covering both the Access to Information Act and the Privacy Act; and 4 sessions to increase awareness of what constitutes personal information under the act.

General ATIP training remains a mandatory requirements for all CFIA employees. Mandatory training is verified on an annual basis.

5. Policies, guidelines and procedures

The CFIA continuously works on process improvements to provide greater oversight and accountability for ATIP activities. The activities related to ATIP are reviewed quarterly and weekly updates regarding request volumes and performance are provided to the offices of both the Ministers of Health and Agriculture and Agri-Food, CFIA's senior management cadre, and key internal partners. While no new policies, guidelines, or procedures were implemented during the reporting period, work was started on a new privacy breach protocol which is intended to be completed in fiscal year 2023 to 2024.

6. Initiatives and projects to improve privacy

The CFIA has begun the process to acquire new request processing software to enhance its ability to respond to requests under the act. The new software will include a suite of modernized tools which should allow the agency to maintain or increase its current service standard in responding to requests.

The ATIP office increased its use of various electronic tools, including the ATIP Online Management Tool and Connect to transfer response packages more quickly. Moreover, the use of secure electronic tools allows the ATIP office to communicate more quickly and efficiently with requesters and reduce the transit time associated with sending information via regular mail.

During the reporting period, the ATIP office secured funding for 2 new positions to augment the delivery of privacy services within the agency. These positions are intended to be staffed during fiscal year 2023 to 2024.

7. Summary of key issues and actions taken on complaints

The CFIA received 4 complaints from the Office of the Privacy Commissioner in 2022 to 2023. 2 complaints concerned delays and 2 complaints concerned the exemption of information. The ATIP office is working with the investigators to resolve these complaints. No complaints were closed in 2022 to 2023.

8. Material privacy breaches

There were no material privacy breaches reported during the reporting period.

9. Privacy impact assessments

There were no privacy impact assessments (PIAs) completed during the reporting period.

10. Public interest disclosures

There were no disclosures made pursuant to section 8(2)(m) of the Privacy Act during the fiscal year 2022 to 2023. Section 8(2)(m) relates to the disclosure of personal information for any purpose where, in the opinion of the head of the institution, clearly outweighs any invasion of privacy that could result from the disclosure, or would clearly benefit the individual to whom the information relates.

11. Monitoring compliance

Given the sensitivity of most requests made under the act, monitoring of the time taken to process personal information requests is done by the ATIP office and is reported to senior management within Communications and Public Affairs Branch. The ATIP office has twice-monthly file review meetings where analysts provide an update on the status of their requests. In addition, team leaders and the manager review individual files with analysts on a regular basis to ensure progress across all files.

Consultations on privacy requests are rarely done and would only be undertaken under exceptional circumstances. Analysts are expected to confer with their team leader or manager prior to initiating any consultations on privacy requests to ensure that the consultation is essential.

The ATIP office is frequently consulted on privacy-related matters concerning the sharing of information both within and external to the agency. The ATIP office provides advice and guidance to various internal stakeholders in the preparation of information sharing agreements, memoranda of understanding, and other CFIA activities.

Appendix A: Statistical report on the Privacy Act

Name of institution: Canadian Food Inspection Agency

Reporting period: April 1, 2022 to March 31, 2023

Section 1: Requests under the Privacy Act

1.1 Number of requests

1.2 Channels of requests

Section 2: Informal requests

2.1 Number of informal requests

2.2 Channels of informal requests

2.3 Completion times of informal requests

2.4 Pages released informally

Section 3: Requests closed during the reporting period

3.1 Dispositions and completion times

3.2 Exemptions

3.3 Exclusions

3.4 Format of information released

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper and e-record formats

3.5.2 Relevant pages processed by request disposition for paper and e-record formats by size of requests

3.5.3 Relevant minutes processed and disclosed for audio formats

3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests

3.5.5 Relevant minutes processed and disclosed for video formats

3.5.6 Relevant minutes processed per request disposition for video formats by size of requests

3.5.7 Other complexities

3.6 Closed requests

3.6.1 Requests closed within legislated timelines

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines

3.7.2 Requests closed beyond legislated timelines (including any extension taken)

3.8 Requests for translation

Section 4: Disclosures under subsections 8(2) and 8(5)

Section 5: Requests for correction of personal information and notations

Section 6: Extensions

6.1 Reasons for extensions

6.2 Length of extensions

Section 7: Consultations received from other institutions and organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

7.2 Recommendations and completion times for consultations received from other Government of Canada institutions

7.3 Recommendations and completion times for consultations received from other organizations outside the Government of Canada

Section 8: Completion times of consultations on Cabinet confidences

8.1 Requests with Legal Services

8.2 Requests with Privy Council Office

Section 9: Complaint and investigation notices received

Section 10: Privacy impact assessments (PIAs) and personal information banks (PIBs)

10.1 Privacy impact assessments

10.2 Institution-specific and central personal information banks

Section 11: Privacy breaches

11.1 Material privacy breaches reported

11.2 Non-material privacy breaches

Section 12: Resources related to the Privacy Act

12.1 Allocated costs

12.2 Human resources

Appendix B: Supplemental statistical report on the Access to Information Act and the Privacy Act

Name of institution: Canadian Food Inspection Agency

Reporting period: April 1, 2022 to March 31, 2023

Section 1: Capacity to receive requests under the Access to Information Act and the Privacy Act

1.1 Number of weeks able to receive requests through different channels

Section 2: Capacity to process records under the Access to Information Act and the Privacy Act

2.1 Number of weeks able to process paper records in different classification levels

2.2 Number of weeks able to process electronic records in different classification levels

Section 3: Open requests and complaints under the Access to Information Act

3.1 Number of open requests that are outstanding from previous reporting periods

3.2 Number of open complaints with the Information Commissioner of Canada that are outstanding from previous reporting periods

Section 4: Open requests and complaints under the Privacy Act

4.1 Number of open requests that are outstanding from previous reporting periods

4.2 Number of open complaints with the Privacy Commissioner of Canada that are outstanding from previous reporting periods

Section 5: Social Insurance Number (SIN)

Section 6: Universal access under the Privacy Act

Appendix C: Delegation order

Access to Information Act and Privacy Act delegation orders

The President of the Canadian Food Inspection Agency pursuant to section 95 of the Access to Information Act and section 73 of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the President as the head of the Canadian Food Inspection Agency, under the provisions of the act and related regulations set out in the schedule opposite each position. This designation replaces all previous delegation orders.

Canadian Food Inspection Agency Delegation Schedule

Original signed by:

Dr. Siddika Mithani, Ph.D.
President, Canadian Food Inspection Agency

Ottawa, Canada
May 10, 2021