2024 to 2025​ Annual report on the Privacy Act

On this page

• Introduction and purpose of the Privacy Act
• Immigration and Refugee Board of Canada
• Communications and Access to Information Directorate
• Delegation of authority
• Performance on the Privacy Act, 2024-2025
• Section 1: Completed requests under the Privacy Act
• Section 2: Active requests under the Privacy Act
• Section 3: Extensions
• Section 4: Consultations received from other institutions and organizations
• Section 5: Summary of key issues and actions taken on complaints
• Section 6: Privacy Impact Assessments (PIAs)
• Section 7: Material Privacy Breaches
• Section 8: Public Interest Disclosures
• Training and awareness
• Monitoring activities
• Education and training activities
• Policies, guidelines, procedures, and initiatives
• Privacy implementation notice
• Initiatives and projects to improve privacy
• Social Insurance Number (SIN)
• Appendix A - Delegation orders (Privacy Act)
• Appendix B - Statistical report on the Privacy Act
• Appendix C - Supplemental Access to Information and Privacy statistical form

Introduction and purpose of the Privacy Act

The Privacy Act (the Act) provides Canadian citizens, permanent residents or any person present in Canada with a right of access to their personal information being held by federal government institutions, subject to specific and limited exceptions. However, and as per the Extension Order No. 3 dated July 13, 2022, all individuals have a general right of access under the Act  to their personal information that is held by federal government institutions, whether they are within or outside Canada.

Section 72(1) of the Actrequires deputy heads of all government institutions to table an annual report on the administration of the Actwithin their respective institutions during each financial year.

This annual report provides a summary of the management and administration of the Actwithin the Immigration and Refugee Board of Canada (IRB) during the 2024-2025 reporting period. It is intended for use by the general public, members of Parliament, and IRB personnel.

Immigration and Refugee Board of Canada

The IRB is Canada’s largest independent administrative tribunal. It is responsible for resolving immigration and refugee cases efficiently, fairly and in accordance with the law.

The IRB is composed of four divisions:

• The Refugee Protection Division (RPD), which decides:
• claims for refugee protection made within Canada;
• applications for vacation of refugee protection; and
• applications for cessation of refugee protection.
• The Immigration Division (ID), which conducts:
• admissibility hearings for foreign nationals or permanent residents who seek entry into Canada, or who are already in Canada and are alleged to be inadmissible; and
• detention reviews for foreign nationals or permanent residents who are detained for immigration reasons.
• The Immigration Appeal Division (IAD), which hears:
• appeals of family sponsorship applications refused by Immigration, Refugees and Citizenship Canada (IRCC);
• appeals from certain removal orders made against permanent residents, Convention refugees and other protected persons, and holders of permanent resident visas;
• appeals by permanent residents against whom an IRCC officer outside of Canada has decided that they have not fulfilled their residency obligation; and
• appeals by the Minister of Public Safety of ID decisions at admissibility hearings.
• The Refugee Appeal Division (RAD) which hears:
  • appeals from decisions of the RPD allowing or rejecting claims for refugee protection;
  • appeals from decisions of the RPD rejecting applications by the Minister for a determination that refugee protection has ceased; and
  • appeals from decisions of the RPD rejecting applications by the Minister to vacate a decision to allow a claim for refugee protection.

The Chairperson of the IRB reports to Parliament through the Minister of Immigration, Refugees and Citizenship Canada.

The institution did not have any non-operational (“paper”) subsidiaries during this reporting period.

Communications and Access to Information Directorate

The Communications and Access to Information Directorate ensures that the IRB meets its statutory obligations under the Access to Information Act and the Privacy Act by:

• processing access and privacy requests made to the IRB;
• responding to consultation requests submitted by other federal institutions;
• providing advice and guidance to IRB personnel regarding the interpretation of both acts as well as related Treasury Board of Canada Secretariat (TBS) policies and guidelines;
• liaising on behalf of the IRB with the TBS, the offices of the Information Commissioner and the Privacy Commissioner and other government departments and agencies on a wide variety of ATIP-related issues ranging from legislative interpretation to details of process and procedures;
• providing input into the development of IRB policies and procedures to ensure that they comply with the provisions of both acts;
• coordinating the preparation of the IRB’s Info Source chapter;
• preparing the annual reports to Parliament on the administration of each act; and
• participating in ATIP forums such as the TBS-led ATIP Community meetings and working groups.

The Access to Information and Privacy (ATIP) Unit, which is within the Communications and Access to Information Directorate is part of the Strategic Directions and Corporate Affairs Branch and includes the following positions: a manager/coordinator, a supervisor, four ATIP officers and two clerks. At year end, six consultants were also hired on a temporary basis to expedite processing of voluminous requests.

Although section 73.1 of the Privacy Act allows institutions reporting to the same Minister to enter into agreements with each other for the purpose of sharing ATIP resources and capacity, the IRB did not have any such service agreement for the reporting period.

Delegation of authority

Pursuant to section 73(1) of the Privacy Act, the deputy head of a government institution may by order designate one or more officers or employees of the institution to exercise or perform any of the powers, duties or functions of the deputy head of the institution. 

Authority to exercise the powers and perform the duties and functions of the Chairperson (deputy head) of the IRB for the purposes of the Act has been delegated to the Executive Director, the Director General of the Strategic Directions and Corporate Affairs Branch, the Director of Communications and Access to Information Directorate, the ATIP Manager/Coordinator and the ATIP supervisor.

The Chairperson, the Executive Director, the Departmental Security Officer, the Deputy Departmental Security Officer and the Regional Security Officer are responsible for approving disclosures of personal information deemed to be in the public interest in accordance with paragraph 8(2)(m) of the Act. 

A copy of the delegation order is enclosed at Appendix A.

Performance on the Privacy Act, 2024—2025

The following provides an overview of the statistical information contained in Appendix B of this report.

Section 1: Completed requests under the Privacy Act

During 2024-2025, 1,001 requests were closed by the IRB within legislated timeframe which represent 94.4% of requests. This reflects a modest decrease in timeliness from 2023-2024 when 95.22% of requests were closed on time. Moreover 33.6% of requests were All Disclosed and 6.5% of requests were Disclosed in Part. The chart below summarizes the length of time required to process the 1,001 requests completed in 2024-2025.

• 561 requests within 15 days (56%);
• 332 requests within 16-30 days (33%);
• 81 requests within 31-60 days (8%);
• 16 requests within 61-120 days (1.5%);
• 2 requests within 121-180 days (0.1%);
• 4 requests within 181-365 days (0.3%); and
• 5 requests in more than 365 days (0.4%).

In regard to the abandoned cases, the applicants either failed to provide sufficient information to allow the IRB to find the requested documentation or failed to obtain written consent from another individual to authorize the IRB to release the personal information.

Furthermore, a total of 559 requests (55%) could not be processed as no relevant records existed.

Section 2: Active Requests under the Privacy Act

At the end of the reporting period, 72 requests were carried over to fiscal year 2025–26. As of March 31, 2025, 55 of these requests were processed within the legislated timelines and 17 requests were beyond the legislated timelines.

Section 3: Extensions

Section 15 of the Act allows government institutions to extend the statutory 30-day time limit for processing a request.

During 2024-2025, 62 extensions were taken based on interference with operations and 1 extension was taken due to cabinet confidences.

The length of extension that was taken for all 63 extensions was for 16 to 30 days.

Section 4: Consultations received from other institutions and organizations

In 2024-2025 there were 2 consultations received from other institutions and organizations. Both consultation requests were received from another government of Canada institution. All records sought were disclosed entirely and both consultations were completed within 30 days.

Section 5: Summary of key issues and actions taken on complaints

In fiscal year 2024-2025, 6 new complaints were filed with the Office of the Privacy Commissioner of Canada against the IRB. These 6 complaints represent 0.6% of all privacy requests received during 2024-2025. The IRB also resolved 10 complaints over the course of the fiscal year. The chart below summarizes the number of active complaints at the end of the fiscal year.

Actions that were taken by the IRB during the reporting period to resolve privacy complaints involved conducting new searches to validate if any records existed and which had not been provided when initially processing the requests.

Section 6: Privacy Impact Assessments (PIAs)

During 2024-2025, no Privacy Impact Assessments were completed or modified. All existing PIAs are publicly available on IRB’s website.

Section 7: Material Privacy Breaches

No material privacy breaches were reported during 2024-2025.

Section 8: Public Interest Disclosures

During 2024-2025, the IRB made one disclosure pursuant to paragraph 8(2)(m) of the Privacy Act. The disclosure was made to assist with a law enforcement investigation. The Office of the Privacy Commissioner was notified prior to the disclosure being made.

Training and awareness

Monitoring activities

The manager, in cooperation with the supervisor and analysts, monitors the processing times for privacy requests, on a weekly basis. In addition, ATIP staff periodically perform diagnostic activities related to the processing of the various requests received. Trends in the requested information are monitored to identify if any frequently requested types of information can be made available via other means.

The ATIP Unit follows the Access to Information Implementation Notice 2022-01: Inter-institutional Consultations and only consults other institutions when more information is needed or when the institution wishes to disclose potentially sensitive information.

Education and training activities

Appendix B of the Directive on Personal Information Requests and Correction of Personal Information sets out mandatory training requirements. In order to ensure all employees have completed the mandatory privacy training set out in this directive, the ATIP office delivered eight (8) awareness sessions to various management tables this year. Individual and informal training was also offered to IRB employees on request.

Employees with functional responsibility for the administration of the Privacy Act and Privacy Regulations were encouraged to take additional in-depth training to support them in their functions.

Policies, guidelines, procedures, and initiatives

Privacy implementation notice

The IRB continues to implement the Privacy Implementation Notice 2020-03: Protecting privacy when releasing information about a small number of individuals during the 2024–2025 reporting period, to prevent inadvertent identification of individuals from small data sets in highly sensitive contexts (e.g., refugee claims).

Initiatives and Projects to Improve Privacy

The ATIP Unit continues to work with the IM/IT team to work on the acquisition and implementation of the new Request Processing Software Solution (RPSS). Once the software is in place, it will increase the efficiency of the processing of requests and modernize the delivery of services.

Social Insurance Number (SIN)

The IRB did not receive authority for a new collection or new consistent use of the SIN in 2024–2025.

Appendix A - Delegation orders (Privacy Act)

The Chairperson of the Immigration and Refugee Board of Canada, pursuant to section 73(1) of the Privay Act^{Footnote 1}, hereby designates the persons holding the positions set out in the schedule below, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Chairperson as the head of the Immigration and Refugee Board of Canada, under the provisions of the Act and related regulations set out in the Schedule opposite each position. This designation replaces all previous delegation orders.

Dated, at the City of Ottawa, this 23 day of October, 2023.

Manon Brassard,
Chairperson

Appendix B - Statistical report on the Privacy Act

Section 1: Requests under the Privacy Act

Section 2: Informal requests

Section 3: Requests closed during the reporting period

3.5 Complexity

3.6 Closed requests

3.7 Deemed refusals

Section 4: Disclosures under subsections 8(2) and 8(5)

Section 5: Requests for correction of personal information and notations

Section 6: Extensions

Section 7: Consultations received from othe institutions and organizations

Section 8: Completion time of consultations on cabinet confidences

Section 9: Complaints and investigations notices received

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

Section 11: Privacy breaches

Section 12: Resources related to the Privacy Act

Appendix C - Supplemental Access to Information and Privacy statistical form

Section 1: Requests Carried Over and Active Complaints Under the Access to Information Act

Section 2: Requests Carried Over and Active Complaints Under the Privacy Act

Section 3: Social Insurance Number (SIN)

Section 4: Universal Access under the Privacy Act