2019-2020 Annual report on the Privacy Act

​​​​​​​​​Table of contents

1. Introduction
2. Immigration and Refugee Board of Canada
3. Access to Information and Privacy and Special Projects Directorate
4. Delegation of Authority
5. Statistical Report on the Privacy Act – Interpretation
1. Requests received
2. Disposition of requests completed
3. Exemptions invoked
4. Exclusions cited
5. Completion time
6. Extensions
7. Translation
8. Method of access
9. Corrections and notation
10. Costs
11. COVID-19
6. Informal Privacy Requests
7. Consultation Requests
8. Complaints and Investigations
9. Monitoring Activities
10. Material Privacy Breaches
11. Education and Training Activities
12. Policies, Guidelines and Procedures
13. Privacy Impact Assessments
14. Disclosures Pursuant to Subsection 8(2) of the Act
15. Reading Rooms
16. Appendix A: Delegation Orders
17. Appendix B: Statistical Report on the Privacy Act
18. Appendix C: Supplemental Statistical Report on the Impact of COVID-19 Measures

1. Introduction

The Privacy Act (the Act) provides Canadian citizens, permanent residents or any person present in Canada with a right of access to their personal information being held by federal government institutions, subject to specific and limited exceptions.

Section 72(1) of the Act requires deputy heads of all government institutions to table an annual report on the administration of the Act within their respective institutions during each financial year.

This annual report provides a summary of the management and administration of the Act within the Immigration and Refugee Board of Canada (IRB) during the 2019–20 reporting period. It is intended for use by the general public, members of Parliament, and IRB personnel.

2. Immigration and Refugee Board of Canada

The IRB is Canada’s largest independent administrative tribunal. It is responsible for resolving immigration and refugee cases efficiently, fairly and in accordance with the law.

The IRB is currently composed of four divisions:

• The Refugee Protection Division (RPD), which decides:
• claims for refugee protection made within Canada;
• applications for vacation of refugee protection; and
• applications for cessation of refugee protection.
• The Immigration Division (ID), which conducts:
• admissibility hearings for foreign nationals or permanent residents who seek entry into Canada, or who are already in Canada and are alleged to be inadmissible; and
• detention reviews for foreign nationals or permanent residents who are detained for immigration reasons.
• The Immigration Appeal Division (IAD), which hears:
• appeals of family sponsorship applications refused by Immigration, Refugees and Citizenship Canada (IRCC);
• appeals from certain removal orders made against permanent residents, Convention refugees and other protected persons, and holders of permanent resident visas;
• appeals by permanent residents against whom an IRCC officer outside of Canada has decided that they have not fulfilled their residency obligation; and
• appeals by the Minister of Public Safety of ID decisions at admissibility hearings.

The fourth division, the Refugee Appeal Division (RAD), was established in December 2012 with the coming into force of the Balanced Refugee Reform Act and the Protecting Canada's Immigration System Act.

• The RAD hears:
• appeals from decisions of the RPD allowing or rejecting claims for refugee protection;
• appeals from decisions of the RPD rejecting applications by the Minister for a determination that refugee protection has ceased; and
• appeals from decisions of the RPD rejecting applications by the Minister to vacate a decision to allow a claim for refugee protection.

The Chairperson of the IRB reports to Parliament through the Minister of Immigration, Refugees and Citizenship Canada.

3. Access to Information and Privacy and Special Projects Directorate

The Access to Information and Privacy (ATIP) and Special Projects Directorate ensures that the IRB meets its statutory obligations under the Access to Information Act and the Privacy Act by:

• processing access and privacy requests for the IRB;
• responding to consultation requests submitted by other federal institutions;
• providing advice and guidance to IRB personnel regarding the interpretation of both acts as well as related Treasury Board of Canada Secretariat (TBS) policies and guidelines;
• liaising on behalf of the IRB with the TBS, the offices of the Information Commissioner and the Privacy Commissioner as well as other government departments and agencies on a wide variety of ATIP-related issues ranging from legislative interpretation to details of process and procedures;
• providing input into the development of IRB policies and procedures to ensure that they are in compliance with the provisions of both acts;
• coordinating the preparation of the IRB’s Info Source chapter;
• preparing the annual reports to Parliament on the administration of each act; and
• participating in ATIP forums such as the TBS’s ATIP Community meetings and working groups.

The ATIP and Special Projects Directorate is part of the Tribunal Services Branch and is staffed by a director/coordinator, a deputy director, six ATIP officers and two clerks.

During the reporting period, the IRB did not provide service to another federal institution, in accordance with section 73.1 of the Privacy Act. This is mainly because of the size of the ATIP and Special Projects Directorate, which is already very small.

4. Delegation of Authority

Pursuant to section 73(1) of the Act, the deputy head of a government institution may by order designate one or more officers or employees of the institution to exercise or perform any of the powers, duties or functions of the deputy head of the institution.

Authority to exercise the powers and perform the duties and functions of the Chairperson (deputy head) of the IRB for the purposes of the Act has been delegated to the Executive Director, the Director General, Tribunal Services Branch, the ATIP Director/Coordinator and the ATIP Deputy Director.

The Chairperson, the Executive Director, the Departmental Security Officer, the Deputy Departmental Security Officer and the Regional Security Officer are responsible for approving disclosures of personal information deemed to be in the public interest in accordance with paragraph 8(2)(m) of the Act.

A copy of the delegation order is enclosed at Appendix A.

5. Statistical Report on the Privacy Act – Interpretation

The following provides an overview of the statistical information contained in Appendix B of this report.

I. Requests received:

The IRB received 2,094 formal privacy requests in 2019–20, representing a 37.9 percent decrease in volume from fiscal year 2018–19, during which 3,372 formal requests were submitted. An additional 320 requests were also carried forward from the previous reporting period.

Over the last five years, the number of requests received and completed by the IRB has diminished from year to year. However, the ATIP Directorate is pleased to report that, on average, 3,868 requests were received and 3,873 requests were completed annually.

II. Disposition of requests completed:

A total of 2,300 formal requests were completed during the 2019–20 reporting period. The completed requests were finalized in the following manner:

Of the 188,759 pages reviewed in response to these requests, 177,601 were released. To compare, 35,000 more pages were reviewed and 33,000 more pages were released in 2019–20 than in the previous fiscal year.

In the 2019–20 fiscal year, a total of 294 requests were completely disclosed, 489 requests were disclosed in part and 10 requests were abandoned. In regards to these 10 abandoned cases, the applicants either failed to provide sufficient information to allow the IRB to find the requested documentation, or failed to obtain written consent from another individual to authorize the IRB to release the personal information.

In addition, a total of 1,505 requests could not be processed as no relevant records existed. Starting in February 2013, each year the IRB’s ATIP Directorate has received a large volume of privacy requests from individuals in Canada who wish to obtain a letter stating that they have never applied for refugee status in order to travel to India. The Consulate General of India requires that an official letter from the IRB be attached to each application. The letter must indicate whether or not the person made a claim for refugee protection and, if they did, whether this claim was allowed, rejected, withdrawn or abandoned.

III. Exemptions invoked:

Section 2.2 of the statistical report outlines the exemptions that were applied in accordance with the Act. In 2019–20, the IRB relied primarily on the exemptions provided for in the following provision of the Act:

• Section 26 dealing with personal information;
• Subsection 22(1) dealing with law enforcement and investigation; and
• Section 27 dealing with the solicitor-client privilege.

It should be noted that if an exemption was applied several times within the same request, it is reported only once in the enclosed statistical report.

IV. Exclusions cited:

Pursuant to sections 69 and 70, this Act does not apply to:

• library or museum material preserved solely for public reference or exhibition purposes;
• materials placed in libraries and museums by or on behalf of persons or organizations other than government institutions; and
• confidences of the Queen’s Privy Council for Canada.

Section 2.3 of the statistical report is reserved for reporting on the number of exclusions applied in accordance with these sections of the Act.

During the 2019–20 reporting period, no exclusions pursuant to sections 69 and 70 of the Act were applied by the IRB.

V. Completion time:

The chart below summarizes the length of time required to process the 2,300 requests completed in 2019–20. Of those requests, 2,289 or 99.5 percent were completed on time.

This means that the IRB responded to a total of:

• 2,034 requests in 30 days or less (88%); and
• 266 requests in 31 days or more (12%).

VI. Extensions:

Section 15 of the Act allows government institutions to extend the statutory 30-day time limit for processing a request.

During the 2019–20 reporting period, a total of 262 extensions were taken by the IRB. In 259 cases, the statutory deadline was extended as meeting the original time limit would have unreasonably interfered with the operations of the IRB. In 2 other case, consultation with another government institution was necessary and could not reasonably be completed within the original time limit. In one case, a translation of records was requested.

VII. Translation:

There was only one request for the translation of records from one official language to the other during the reporting period.

VIII. Method of access:

In 2019–20, access to the records was given in whole or in part in 783 cases. Copies of the requested material were provided in 121 of those cases, while in the other 662 cases, the records were provided on an electronic support.

It should be noted that these figures are based solely on those requests for which information was disclosed.

IX. Corrections and notation:

No requests for correction to personal information were completed during the reporting period.

X. Costs:

In 2019–20, the total costs incurred by the ATIP and Special Projects Directorate for the administration of the Act is estimated to be $539,753 all in salaries. The employee resources for this reporting period are estimated at 8 FTEs.

XI. COVID-19:

The exceptional measures to curb COVID-19 implemented by the Government of Canada have had a significant impact on the IRB’s ability to fulfill its responsibilities set out in the Privacy Act. Even if teleworking was a common practice at the ATIP and Special Projects Directorate, our main challenge was to get records from the various regional offices, which had no access to the requested records.

6. Informal Privacy Requests

The IRB processed 27 informal privacy requests during the reporting period. A total of 840 pages were reviewed and 825 pages were released to the applicants.

7. Consultation Requests

The IRB responded to four consultation requests made by other government institutions in 2019–20. A total of 53 pages were reviewed in response to this consultation, and all pages were recommended for release to the applicant.

8. Complaints and Investigations

In fiscal year 2019–20, a new complaint was filed with the Office of the Privacy Commissioner of Canada against the IRB. This represents 0.4% of all requests received and completed during this same period. This complaint was ongoing at year end and is related to the sharing of personal information without the required consent.

No audits were conducted during 2019–20.

9. Monitoring Activities

The director, in cooperation with the analysts, monitors the processing times for privacy requests, on a weekly basis. In addition, ATIP staff periodically perform diagnostic activities related to the processing of the various requests received.

10. Material Privacy Breaches

During the reporting period, the IRB identified eight cases of privacy breaches, for which four evaluations have been completed. The Board did not inform the Office of the Privacy Commissioner of Canada because, in all four cases, the risk was deemed low and the information was quickly contained. The other four possible privacy breaches are currently being assessed.

11. Education and Training Activities

No formal session was delivered to IRB employees.

12. Policies, Guidelines and Procedures

The IRB did not implement any new and/or revised privacy-related policies, guidelines or procedures during the 2019–20 reporting period.

13. Privacy Impact Assessments

The IRB did not complete any Privacy Impact Assessments in 2019–20.

14. Disclosures Pursuant to Subsection 8(2) of the Act

In 2019-20, personal information was disclosed in accordance with the following paragraphs of the Act in the number of cases set out in the table below:

15. Reading Rooms

Individuals who wish to examine records released under the Act can contact the ATIP and Special Projects Directorate to make arrangements to view release packages at the IRB Headquarters in Ottawa or at one of its regional offices.

Appendices