2024 to 2025 Annual Report on the Privacy Act

ISSN: 2818-8152

On this page

• 1. Introduction
• 2. Organizational structure
• 3. Delegation order
• 4. Performance 2024 to 2025
• 5. Training and awareness
• 6. Policies, guidelines, and procedures
• 7. Initiatives and projects to improve privacy
• 8. Summary of key issues and actions taken on complaints
• 9. Material privacy breaches
• 10. Privacy impact assessments
• 11. Public interest disclosures
• 12. Monitoring compliance
• Appendix A: Delegation order

1. Introduction

The Privacy Act (hereafter referred to as the act) gives individuals the right to access their own personal information held by the Government of Canada. The actalso protects the privacy of individuals by respecting parameters relating to the collection, use, disclosure, retention, and disposal of personal information held by federal government institutions.

In accordance with section 72 of the act, the head of every Government institution prepares an annual report on the administration of the act within that institution. This report describes how the Canadian Food Inspection Agency (CFIA) administered the act for fiscal year 2024 to 2025.

As part of its commitment to openness and transparency, the CFIA recognizes the right to access information in government records and makes every reasonable effort to assist those that request access to their personal information.

Mandate of the Canadian Food Inspection Agency

Mitigating risks to food safety is the CFIA's highest priority, and the health and safety of Canadians is the driving force behind the design and development of CFIA programs. The CFIA, in collaboration and partnership with industry, consumers, and federal, provincial and municipal organizations, continues to work towards protecting Canadians from preventable health risks related to food and zoonotic diseases.

The current and future economic prosperity of the Canadian agriculture and forestry sectors relies on a healthy and sustainable animal and plant resource base. As such, the CFIA is continually improving its program design and delivery in the animal health and plant resource areas in order to minimize and manage risks. In an effort to protect the natural environment from invasive animal and plant diseases and plant pests, the CFIA also performs extensive work related to the protection of environmental biodiversity.

Non-operational subsidiaries

The CFIA did not have any non-operational subsidiaries during this reporting period.

2. Organizational structure

Administration of the act

Administration of the act within the CFIA is the primary responsibility of the Access to Information and Privacy (ATIP) office, which is part of the agency's Policy and Programs Branch. The ATIP office processes all requests for personal information and coordinates all activities related to the act, associated regulations, directives and guidelines. The CFIA was not party to any agreements under section 73.1 of the act during this reporting period.

Resources

The ATIP office is headed by a director who reports to the Senior Director, Corporate Secretariat. During the reporting period, there were 16.24 full-time equivalents, 0.550 students and 0.815 persons (contracted consultants) dedicated to the ATIP office. In addition to the ATIP office resources, there are also dedicated ATIP advisor positions in the core branches who report on branch-related ATIP issues and activities. These branch advisors work with the ATIP office to ensure an efficient and effective process to respond to applicants in a timely manner.

An estimated $343.8K in salary costs and $103.2K in operating costs were incurred by the ATIP office to administer the Privacy Act for the reporting period. These costs do not include resources within each branch (such as the branch ATIP advisors), or any other expenditures incurred by the branches and program areas to meet the requirements of the act.

3. Delegation order

Delegation orders set out what powers, duties, and functions for the administration of the Privacy Act have been delegated by the head of the institution and to whom. A copy of the CFIA's most recent delegation order can be found in Appendix A of this report.

4. Performance 2024 to 2025

The CFIA received 48 new privacy requests under the Privacy Act between April 1, 2024 and March 31, 2025. This represents an increase of approximately 45% from the previous reporting period. There were 8 outstanding requests from the previous year, increasing the total to 56 requests that required processing. A total of 45 requests were completed during the reporting period leaving a total of 11 to be carried forward in fiscal year 2025 to 2026. These 45 completed requests represented a total of 123,444 pages that were reviewed and 9,070 that were released pursuant to the act.

Throughout the reporting period, the ATIP office's service standard decreased to approximately 86% of the requests closed within legislated timelines. This represents a decrease of 3% from fiscal year 2023 to 2024.

The following table outlines the cycle of privacy requests at CFIA for the last 5 fiscal years:

As of March 31, 2025, the CFIA had 11 active requests under the act, 8 received in 2024 to 2025, and 3 received in 2023 to 24. 2 of those requests were within legislated timelines and 9 were carried over beyond legislated timelines. In addition, the CFIA had 2 active complaints, 1 of which was received in 2024 to 2025 and the other received in 2022 to 2023.

Consultations

There were no consultations received from other institutions during the reporting period.

Completion times

The 45 requests completed in 2024 to 2025 were processed in the following timeframes:

• 25 within 30 days or less (55%)
• 12 within 31 to 60 days (27%)
• 4 within 61 to 120 days (9%)
• 1 within 121 to 180 days (2%)
• 3 within 181 to 365 days (7%)
• 0 over 365 days (0%)

Disposition of completed requests

The disposition of the 45 completed requests consisted of releases broken down as follows:

• 2 were fully disclosed (4.5%)
• 20 were partially disclosed (44.5%)
• 6 consisted of a request where no records existed (13%)
• 17 were abandoned (38%)

Extensions

It was necessary to extend the 30 calendar day time limit for 17 requests. A total of 22 extensions were taken on those 17 requests. 16 of the extensions were taken under 15(a)(i), interference with operations, and 1 extension was taken under 15(a)(ii), consultation. Of the 16 extensions taken under interference with operations, 12 were for requests with a large volume of pages, 2 were due to a large volume of requests, 5 for further review to determine exemptions, and 1 for documents which were difficult to obtain.

5. Training and awareness

The ATIP office delivered 5 virtual and/or in-person training sessions to 157 employees during fiscal year 2024 to 2025. The purpose of these training sessions was to increase awareness of the Access to Information Act and the Privacy Act, clarify requirements under the acts, and highlight topics including the management of personal information and privacy breach protocols; all of which facilitate the CFIA in meeting its obligations. General ATIP training remains a mandatory requirement for all CFIA employees.

Additionally, the ATIP office actively promotes ongoing awareness through direct engagement with, and support for, employees with delegated or functional responsibility under the Acts. These employees are provided with targeted training aligned with Appendix B of the Directive on Personal Information Requests and Correction of Personal Information. Further, monthly file review meetings including all ATIP analysts and regular bilateral meetings between analysts and their managers provide opportunities for shared learning and the discussion of best practices.

6. Policies, guidelines and procedures

The CFIA continuously works on process improvements to provide greater oversight and accountability for ATIP activities. The activities related to ATIP are reviewed regularly and weekly updates regarding request volumes and performance are provided to the offices of both the Ministers of Health and Agriculture and Agri-Food, CFIA's senior management cadre, and key internal partners.

7. Initiatives and projects to improve privacy

The CFIA has acquired a new request processing software to enhance its ability to respond to requests under the act. The new software includes a suite of modernized tools which should allow the agency to maintain or increase its current service standard in responding to requests. Implementation of the new software is ongoing and it is anticipated the new software will be fully operational by the third quarter of 2025 to 2026.  The CFIA will continue to run its current software in parallel with the new system for a period of time.

8. Summary of key issues and actions taken on complaints

The CFIA received 1 complaint from the Office of the Privacy Commissioner in 2024 to 2025. The complaint concerned the exemption of information and missing records. In addition, there was 1 complaint carried over from 2022 to 2023. The ATIP office is working with the investigators to resolve these complaints. 2 complaints, both deemed well-founded, were closed in 2024 to 2025. 1 complaint was resolved however no actions were required as the records had already been released to the request. The other complaint was resolved by the release of additional information to the requester.

9. Material privacy breaches

There were no material privacy breaches reported during the reporting period. CFIA was implicated in the BGRS privacy breach reported by TBS and collaborated with TBS to ensure it obtained all the data necessary to enable its investigation and coordinated response. Work included coordination with groups internal to the agency for the purpose of identifying those potentially impacted by the breach. CFIA's ATIP office also worked internally to inform employees of the breach and provide periodic updates as they became available.

10. Privacy impact assessments

There were no privacy impact assessments (PIA) completed during the reporting period.

11. Public interest disclosures

No public interest disclosures of personal information were made pursuant to section 8(2)(m) of the Privacy Act during the reporting period. Section 8(2)(m) relates to the disclosure of personal information for any purpose where, in the opinion of the head of the institution, clearly outweighs any invasion of privacy that could result from the disclosure, or would clearly benefit the individual to whom the information relates.

12. Monitoring compliance

Given the sensitivity of most requests made under the act, monitoring of the time taken to process personal information requests is done by the ATIP office and is reported to senior management as needed. The ATIP office has bi-weekly file review meetings where analysts provide an update on the status of their requests. In addition, the team leader and managers review individual files with analysts on a regular basis to ensure progress across all files.

Consultations on privacy requests are rare and are only undertaken under exceptional circumstances. Analysts are expected to confer with their team leader or manager prior to initiating any consultations on privacy requests to ensure that the consultation is essential.

The ATIP office is frequently consulted on privacy-related matters concerning the sharing of information both within and external to the agency. The ATIP office provides advice and guidance to various internal stakeholders in the preparation of information sharing agreements, memoranda of understanding, and other CFIA activities.

Appendix A: Delegation order

Access to Information Act and Privacy Act delegation orders

The President of the Canadian Food Inspection Agency pursuant to section 95 of the Access to Information Act and section 73 of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the President as the head of the Canadian Food Inspection Agency, under the provisions of the act and related regulations set out in the schedule opposite each position. This designation replaces all previous delegation orders.

Canadian Food Inspection Agency delegation schedule

Original signed by:

Paul MacKinnon
President, Canadian Food Inspection Agency

Ottawa, Canada
September 2, 2025