2021 to 2022 Annual report on the Privacy Act

​On this page

• Introduction and purpose of the Privacy Act
• Immigration and Refugee Board of Canada
• Communications and Access to Information Directorate
• Delegation of authority
• Statistical report on the Privacy Act – Interpretation
• Section 1: Requests under the Privacy Act
• 1.1 Number of requests received
• 1.2 Channels of requests
• Section 2: Informal requests
• 2.1 Number of informal requests
• 2.2 Channels of informal requests
• 2.3 Completion time of informal requests
• 2.4 Pages released informally
• Section 3: Requests closed during the reporting period
• 3.1 Disposition and completion time
• 3.2 Exemptions
• 3.3 Exclusions
• 3.4 Format of information released
• 3.5 Complexity
• 3.5.1 Relevant pages processed and disclosed for paper and e-records formats
• 3.5.2 Relevant pages processed by request disposition for paper and e-records formats by size of requests
• 4.5.3 Relevant minutes processed and disclosed for audio formats
• 3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests
• 3.5.5 Relevant minutes processes and disclosed for video formats
• 3.5.6 Relevant minutes processed per request disposition for video formats by size of requests
• 3.5.7 Other complexities
• 3.6 Closed requests
• 3.6.1 Requests closed within legislated timelines
• 3.7 Deemed refusals
• 3.7.1 Reasons for not meeting legislated timelines
• 3.7.2 Request closed beyond legislated timelines (including any extension taken)
• 3.8 Requests for translations
• Section 4: Disclosures under subsections 8(2) and 8(5)
• Section 5: Requests for correction of personal information and notations
• Section 6: Extensions
• 6.1 Reasons for extensions
• 6.2 Length of extensions
• Section 7: Consultations received from other institutions and organizations
• 7.1 Consultations received from other Government of Canada institutions and other organizations
• 7.2 Recommendations and completion time for consultations received from other Government of Canada institutions
• 7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada
• Section 8: Completion time of consultations on cabinet confidences
• 8.1 Requests with Legal Services
• 8.2 Requests with Privy Council Office
• Section 9: Complaints and investigations notices received
• Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)
• 10.1 Privacy Impact Assessments
• 10.2 Institution-specific and Central Personal Information Banks
• Section 11: Privacy breaches
• 11.1 Material privacy breach reports
• 11.2 Non-material privacy breach
• Section 12: Resources related to the Privacy Act
• 12.1 Allocated costs
• 12.2 Human resources
• Training and awareness
• Monitoring activities
• Education and training activities
• Policies, guidelines, procedures, and initiatives
• Privacy implementation notice
• Social Insurance Number (SIN)
• Reading Rooms
• Impact of pandemic (COVID-19)
• Appendix A - Delegation orders (Privacy Act)
• Appendix B - Statistical report on the Privacy Act
• Appendix C - Supplemental Access to Information and Privacy statistical form

Introduction and purpose of the Privacy Act

The Privacy Act (the Act) provides Canadian citizens, permanent residents or any person present in Canada with a right of access to their personal information being held by federal government institutions, subject to specific and limited exceptions.

Section 72(1) of the Act requires deputy heads of all government institutions to table an annual report on the administration of the Act within their respective institutions during each financial year

This annual report provides a summary of the management and administration of the Act within the Immigration and Refugee Board of Canada (IRB) during the 2021–22 reporting period. It is intended for use by the general public, members of Parliament, and IRB personnel.

Immigration and Refugee Board of Canada

The IRB is Canada’s largest independent administrative tribunal. It is responsible for resolving immigration and refugee cases efficiently, fairly and in accordance with the law.

The IRB is currently composed of four divisions:

• The Refugee Protection Division (RPD), which decides:
• claims for refugee protection made within Canada
• applications for vacation of refugee protection, and
• applications for cessation of refugee protection.
• The Immigration Division (ID), which conducts:
• admissibility hearings for foreign nationals or permanent residents who seek entry into Canada, or who are already in Canada and are alleged to be inadmissible, and
• detention reviews for foreign nationals or permanent residents who are detained for immigration reasons.
• The Immigration Appeal Division (IAD), which hears:
• appeals of family sponsorship applications refused by Immigration, Refugees and Citizenship Canada (IRCC)
• appeals from certain removal orders made against permanent residents, Convention refugees and other protected persons, and holders of permanent resident visas
• appeals by permanent residents against whom an IRCC officer outside of Canada has decided that they have not fulfilled their residency obligation, and

appeals by the Minister of Public Safety of ID decisions at admissibility hearings.

The fourth division, the Refugee Appeal Division (RAD), was established in December 2012 with the coming into force of the Balanced Refugee Reform Act and the Protecting Canada's Immigration System Act.

• The RAD hears:
• appeals from decisions of the RPD allowing or rejecting claims for refugee protection;
• appeals from decisions of the RPD rejecting applications by the Minister for a determination that refugee protection has ceased, and
• appeals from decisions of the RPD rejecting applications by the Minister to vacate a decision to allow a claim for refugee protection.

The Chairperson of the IRB reports to Parliament through the Minister of Immigration, Refugees and Citizenship Canada.

Communications and Access to Information Directorate

The Communications and Access to Information Directorate ensures that the IRB meets its statutory obligations under the Access to Information Act and the Privacy Act by:

• processing access and privacy requests for the IRB
• responding to consultation requests submitted by other federal institutions
• providing advice and guidance to IRB personnel regarding the interpretation of both acts as well as related Treasury Board of Canada Secretariat (TBS) policies and guidelines
• liaising on behalf of the IRB with the TBS, the offices of the Information Commissioner and the Privacy Commissioner as well as other government departments and agencies on a wide variety of ATIP-related issues ranging from legislative interpretation to details of process and procedures
• providing input into the development of IRB policies and procedures to ensure that they are in compliance with the provisions of both acts
• coordinating the preparation of the IRB’s Info Source chapter
• preparing the annual reports to Parliament on the administration of each act; and
• participating in ATIP forums such as the TBS’s ATIP Community meetings and working groups.

The Access to Information and Privacy (ATIP) Unit, which is within the Communications and Access to Information Directorate is part of the Strategic Directions and Corporate Affairs Branch and is staffed by a manager/coordinator, a supervisor, six ATIP officers and two clerks.

Although section 73.1 of the Privacy Act allows institutions reporting to the same Minister to enter into agreements with each other for the purpose of sharing ATIP resources and capacity, the IRB did not have any such service agreement for the reporting period.

Delegation of authority

Pursuant to section 73(1) of the Privacy Act, the deputy head of a government institution may by order designate one or more officers or employees of the institution to exercise or perform any of the powers, duties or functions of the deputy head of the institution.  

Authority to exercise the powers and perform the duties and functions of the Chairperson (deputy head) of the IRB for the purposes of the Act has been delegated to the Executive Director, the Director General of the Strategic Directions and Corporate Affairs Branch, the Director of Communications and Access to Information Directorate, the ATIP Manager/Coordinator and the ATIP supervisor.

The Chairperson, the Executive Director, the Departmental Security Officer, the Deputy Departmental Security Officer and the Regional Security Officer are responsible for approving disclosures of personal information deemed to be in the public interest in accordance with paragraph 8(2)(m) of the Act. 

A copy of the delegation order is enclosed at Appendix A.

Statistical report on the Privacy Act – Interpretation

The following provides an overview of the statistical information contained in Appendix B of this report.

Section 1: Requests under the Privacy Act

1.1 Number of requests received

The IRB received 1,775 formal privacy requests in 2021–22, representing a 32.7 percent increase in volume from fiscal year 2020–21, during which 1,338 formal requests were submitted.

An additional 66 requests were outstanding from the previous reporting period and a total of 74 requests received in 2021–22 were carried over to fiscal year 2022–23. As of March 31, 2022, these requests were processed within the legislated timelines.

The principal highlights for the last five reporting periods are set out in the table below:

Over the last five years, the number of requests received and completed by the IRB has fluctuated from year to year. However, the ATIP Unit is pleased to report that, on average, 2399 requests were received, and 2363 requests were completed annually.

1.2 Channels of requests

During 2021–22, 1,309 requests (74%) were received by email, 301 requests were received online (17%), 92 requests were received by fax (5%) and 73 requests were received by mail (4%).

No request was received in person or by phone.

Section 2: Informal requests

2.1 Number of informal requests

The IRB processed a total of 78 informal privacy requests during the reporting period. A total of 62 requests were received during this reporting period and 16 requests were outstanding from previous reporting periods (11 requests from 2020–21 and 5 requests from 2019–20). A total of 55 were closed during 2021–22 and 23 requests were carried over into 2022–23.

2.2 Channels of informal requests

All the informal requests (78) were received by email. 

2.3 Completion time of informal requests

Of the 78 requests processed, 55 were closed during the reporting period. Of these 55 requests, 2 were processed within 31-60 days, 7 were processed within 61-120 days, 19 were processed within 121-180 days, 12 were processed within 181-365 days, and 15 were processed in more than 365 days.

2.4 Pages released informally

From the 55 informal requests that were processed, pages were released for only 2 requests. This represents 731 pages processed and 729 pages released. No pages were release in response to the remaining 53 informal requests as these were internal informal requests related to privacy breaches that occurred during the reporting period.

For more information on the privacy breaches, please consult section 11 of this report.

Section 3: Requests closed during the reporting period

3.1 Disposition and completion time

The chart below summarizes the length of time required to process the 1,767 requests completed in 2021–22.

This means that the IRB responded to a total of:

• 1,070 requests within 15 days (61%)
• 611 requests within 16-30 days (34%)
• 63 requests within 31-60 days (4%)
• 23 requests in 61 to 120 days (1%)

Furthermore, and regarding the disposition:

• 30.5% of requests were closed as all disclosed
• 4.4% of requests were closed as disclosed in part
• 62.7% of requests were closed as no records exist
• 0.4% of requests were closed as transferred
• 2% of requests were closed as abandoned

In regard to the abandoned cases, the applicants either failed to provide sufficient information to allow the IRB to find the requested documentation or failed to obtain written consent from another individual to authorize the IRB to release the personal information.

In addition, a total of 1,107 requests (62.7 percent) could not be processed as no relevant records existed. Starting in February 2013, each year the IRB’s ATIP Unit has received a large volume of privacy requests from individuals in Canada who wish to obtain a letter stating that they have never applied for refugee status in order to travel to India. The Consulate General of India requires that an official letter from the IRB be attached to each application. The letter must indicate whether or not the person made a claim for refugee protection and, if they did, whether this claim was allowed, rejected, withdrawn or abandoned.

3.2 Exemptions

Section 3.2 of the statistical report outlines the exemptions that were applied in accordance with the Act. In 2021–22, the IRB relied primarily on the exemptions provided for in the following provision of the Act:

• Section 26 dealing with personal information; and
• Subsection 22(1) dealing with law enforcement and investigations.

It should be noted that if an exemption was applied several times within the same request, it is reported only once in the enclosed statistical report.

3.3 Exclusions

During the 2021–22 reporting period, no exclusions pursuant to sections 69 and 70 of the Act were applied by the IRB.

3.4 Format of information released

Consistent with previous reporting period, the electronic format was mostly used (92%) for the release of information. In addition, the format of information released was audio for 53 requests (7.9%) and the format of information released was paper copy in only one case (0.1%).

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper and e-records formats

A total of 171,135 pages were processed and 167,563 were released during last fiscal year. To compare, approximately 39,300 more pages were processed, and 38,000 more pages were released in 2021–22 than in the previous fiscal year.

The chart below summarizes the number of pages processed and released in the last five reporting periods.

3.5.2 Relevant pages processed by request disposition for paper and e-records formats by size of requests

Last fiscal year, a total of 308 requests had less than 100 pages processed. In addition to that, 259 had between 100-500 pages processed, 62 had between 501-1,000 pages processed, 30 had between 1,001-5,000 pages processed, and 1 had more than 5,000 pages processed.

3.5.3 Relevant minutes processed and disclosed for audio formats

Overall, 53 requests for audio were received last fiscal year which represent a total of 11,188 minutes that were processed and disclosed.

3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests

With regard to the relevant minutes processed by size of those 8 requests, we can establish the following:

• in 4 cases, less than 60 minutes were processed (total of 112 minutes)
• in 11 cases, between 60 and 120 minutes were processed (total of 1,134 minutes), and
• in 38 cases, more than 120 minutes were processed (total of 9,942 minutes)

3.5.5 Relevant minutes processes and disclosed for video formats

No request for video was received last fiscal year.

3.5.6 Relevant minutes processed per request disposition for video formats by size of requests

No request for video was received last fiscal year.

3.5.7 Other complexities

Last fiscal year, 133 requests had complexities; they either required consultation (1) or legal advice (2), had interwoven information (82) or some other complexities (48).

3.6 Closed requests

3.6.1 Number of requests closed within legislated timelines

During 2021-22, 1724 requests were closed within legislated timeframe which represent 97.6%.

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines

Section 15 of the Act allows government institutions to extend the statutory 30-day time limit for processing a request.

During the 2021–22 reporting period, a total of 43 requests were closed past the legislated timeline. In 42 cases, the reason for closing past the legislated timelines was that meeting the original time limit would have unreasonably interfered with the operations of the IRB. In one case, consultation with another government institution was necessary and could not reasonably be completed within the original time limit.

3.7.2 Request closed beyond legislated timelines (including any extension taken)

Of these 43 requests, 19 were processed within 15 days past legislated timelines, 4 were processed within 16-30 days past legislated timelines, 2 were processed within 31-60 days past legislated timelines, 3 were processed within 61-120 days past legislated timelines, 1 was processed within 121-180 days past legislated timelines 5 were processed within 181-365 days past legislated timelines, and 9 were processed in more than 365 days past legislated timelines.

3.8 Requests for translations

There was no request for the translation of records from one official language to the other during the reporting period.

Section 4: Disclosures under subsections 8(2) and 8(5)

In 2021–22, personal information was disclosed in accordance with the following paragraphs of the Act as set out in the table below:

As shown in the above chart, most disclosures were done under paragraphs 8(2)(a), 8(2)(b) and 8(2)(e). There were no disclosures under paragraph 8(2)(m) and subsection 8(5) during 2021–22.

Section 5: Requests for correction of personal information and notations

No requests for correction to personal information were completed during the reporting period.  

Section 6: Extensions

6.1 Reasons for extensions

Last reporting period, almost all extensions were taken based on interference with operations. Only one extension was taken for consultation purposes.

6.2 Length of extensions

The length of extension that was taken for all 48 extensions was for 16 to 30 days. 

Section 7: Consultations received from other Institutions and Organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

There was no consultation received from other institutions and organizations.

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

There was no consultation received from other institutions and organizations.

7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada

There were no consultations received from other institutions and organizations.

Section 8: Completion time of consultations on cabinet confidences

8.1 Requests with Legal Services

There was no consultation request on Cabinet Confidence with Legal Services.

8.2 Requests with Privy Council Office

There was no consultation request on Cabinet Confidence with Privy Council Office.

Section 9: Complaints and investigations notices received

In fiscal year 2021–22, the IRB processed 5 complaints. Of these 5 complaints, two new complaints were filed with the Office of the Privacy Commissioner of Canada against the IRB. One of them was resolved and closed by the end of the fiscal year. The other one was ongoing at year end and have been carried over into 2022-23.

In addition, three complaints which had been received in previous reporting periods (1 in 2019–20 and 2 in 2020–21) were processed last fiscal year. Of these 3 complaints, two were closed during reporting period and two were ongoing at year end and have been carried over into 2022–23. These 5 complaints represent 0.3% of all requests received during 2021-22, including those outstanding from previous reporting periods.

No audits were conducted during 2021–22.

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

10.1 Privacy Impact Assessments

During 2021–22, no Privacy Impact Assessments were completed or modified

10.2 Institution-specific and Central Personal Information Banks

The IRB has seven active Personal Information Banks; however, the Board did not create or modify any Personal Information Banks in 2021–22.

Section 11: Privacy breaches

11.1 Material privacy breach reports

One material privacy breach was reported during 2021–22. As the risk was deemed high, the Board informed both the Office of the Privacy Commissioner of Canada and the TBS.

11.2 Non-material privacy breach

During the reporting period, the IRB identified 59 new cases of non-material privacy breaches. In addition, 16 cases of non-material privacy breaches were outstanding from previous reporting periods (11 requests from 2020–21 and 5 requests from 2019–20). From these 75 actives cases, a total of 52 evaluations have been completed. The remaining 23 possible privacy breaches are currently being assessed and have been carried over into 2022–23. The Board did not inform the Office of the Privacy Commissioner of Canada because, in all 52 cases, the risk was deemed low and the information was quickly contained.

Section 12: Resources related to the Privacy Act

12.1 Allocated costs

In 2021–22, the total costs incurred by the Communications and Access to Information Directorate for the administration of the Act is estimated to be $351,032, all in salaries.

The chart below shows the expenditures’ breakdown for 2021–22:

12.2 Human resources

The employee resources for this reporting period are estimated at 6 FTEs.

Training and awareness

Monitoring activities

The manager, in cooperation with the supervisor and analysts, monitors the processing times for privacy requests, on a weekly basis. In addition, ATIP staff periodically perform diagnostic activities related to the processing of the various requests received.

Education and training activities

No formal session was delivered to IRB employees.  However, individual and informal training was offered when needed.

Policies, guidelines, procedures, and initiatives

Privacy Implementation Notice

The IRB continues to implement the Privacy Implementation Notice 2020-03: Protecting privacy when releasing information about a small number of individuals during the 2021–22 reporting period, to prevent inadvertent identification of individuals from small data sets in highly sensitive contexts (e.g. refugee claims).

Social Insurance Number (SIN)

The IRB did not receive authority for a new collection or new consistent use of the SIN in 2021–2022.

Reading rooms

Individuals who wish to examine records released under the Act can contact the Communications and Access to Information Directorate to make arrangements to view release packages at the IRB Headquarters in Ottawa or at one of its regional offices. However, and due to the exceptional measures to curb COVID-19 implemented by the Government of Canada, it has not been possible to do so in 2021–22.

Impact of pandemic (COVID-19)

In fiscal year 2021-22, the pandemic had no impact on the IRB’s ability to receive requests as set out in the Privacy Act. No procedural challenges were observed while employees were working from home. Teleworking was already in place in the ATIP Unit before the pandemic.

Appendix A - Delegation orders (Privacy Act)

The Chairperson of the Immigration and Refugee Board of Canada, pursuant to section 73(1) of the Privacy Act^{Footnote 1}, hereby designates the persons holding the positions set out in the schedule below, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Chairperson as the head of the Immigration and Refugee Board of Canada, under the provisions of the Act and related regulations set out in the Schedule opposite each position. This designation replaces all previous delegation orders.

Dated, at the City of Ottawa, this 12 day of January 2021.

Richard Wex,
Chairperson

Appendix B - Statistical report on the Privacy Act

Section 1: Requests under the Privacy Act

Section 2: Informal requests

Section 3: Requests closed during the reporting period

3.5 Complexity

3.6 Closed requests

3.7 Deemed refusals

Section 4: Disclosures under subsections 8(2) and 8(5)

Section 5: Requests for correction of personal information and notations

Section 6: Extensions

Section 7: Consultations received from othe institutions and organizations

Section 8: Completion time of consultations on cabinet confidences

Section 9: Complaints and investigations notices received

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

Section 11: Privacy breaches

Section 12: Resources related to the Privacy Act

Appendix C - Supplemental Access to Information and Privacy statistical form

Section 1: Capacity to receive requests under the Access to Information Act and the Privacy Act

Section 2: Capacity to process records under the Access to Information Act and the Privacy Act

Section 3: Open requests and complaints under the Access to Information Act

Section 4: open requests and complaints under the Privacy Act

Section 5: Social Insurance Number (SIN)