2020-2021 Annual report on the Privacy Act

​​​Table of contents

1. Introduction
2. Immigration and Refugee Board of Canada
1. ​ Immigration and Refugee Board of Canada
2. Communications and Access to Information Directorate
3. Delegation of authority
4. Statistical report on the Privacy Act – Interpretation
1. Requests received
2. Disposition of requests completed
3. Exemptions invoked
4. Exclusions cited
5. Completion time
6. Extensions
7. Translation
8. Method of access
9. Corrections and notation
10. Costs
11. COVID-19
5. Informal privacy requests
6. Consultation requests
7. Complaints and investigations
8. Monitoring activities
9. Material privacy breaches
10. Education and training activities
11. Policies, guidelines and procedures
12. Privacy impact assessments
13. Disclosures pursuant to Subsection 8(2) of the Act
14. Reading rooms
15. Appendix A: Delegation Orders
16. Appendix B: Statistical Report on the Privacy Act
17. Appendix C: 2020-2021 Supplemental Statistical Access to Information and Privacy Statistical Form

1. Introduction

The Privacy Act (the Act) provides Canadian citizens, permanent residents or any person present in Canada with a right of access to their personal information being held by federal government institutions, subject to specific and limited exceptions.

Section 72(1) of the Act requires deputy heads of all government institutions to table an annual report on the administration of the Act within their respective institutions during each financial year.

This annual report provides a summary of the management and administration of the Act within the Immigration and Refugee Board of Canada (IRB) during the 2020-21 reporting period. It is intended for use by the general public, members of Parliament, and IRB personnel.

2. Immigration and Refugee Board of Canada

I. The Immigration and Refugee Board

The IRB is Canada’s largest independent administrative tribunal. It is responsible for resolving immigration and refugee cases efficiently, fairly and in accordance with the law.

The IRB is currently composed of four divisions:

• The Refugee Protection Division (RPD), which decides:
• claims for refugee protection made within Canada;
• applications for vacation of refugee protection; and
• applications for cessation of refugee protection.
• The Immigration Division (ID), which conducts:
• admissibility hearings for foreign nationals or permanent residents who seek entry into Canada, or who are already in Canada and are alleged to be inadmissible; and
• detention reviews for foreign nationals or permanent residents who are detained for immigration reasons.
• The Immigration Appeal Division (IAD), which hears:
• appeals of family sponsorship applications refused by Immigration, Refugees and Citizenship Canada (IRCC);
• appeals from certain removal orders made against permanent residents, Convention refugees and other protected persons, and holders of permanent resident visas;
• appeals by permanent residents against whom an IRCC officer outside of Canada has decided that they have not fulfilled their residency obligation; and
• appeals by the Minister of Public Safety of ID decisions at admissibility hearings.

The fourth division, the Refugee Appeal Division (RAD), was established in December 2012 with the coming into force of the Balanced Refugee Reform Act and the Protecting Canada's Immigration System Act.

The RAD hears:

• appeals from decisions of the RPD allowing or rejecting claims for refugee protection;
• appeals from decisions of the RPD rejecting applications by the Minister for a determination that refugee protection has ceased; and
• appeals from decisions of the RPD rejecting applications by the Minister to vacate a decision to allow a claim for refugee protection.

The Chairperson of the IRB reports to Parliament through the Minister of Immigration, Refugees and Citizenship Canada.

II. Communications and Access to Information Directorate

The Communications and Access to Information Directorate ensures that the IRB meets its statutory obligations under the Access to Information Act and the Privacy Act by:

• processing access and privacy requests for the IRB;
• responding to consultation requests submitted by other federal institutions;
• providing advice and guidance to IRB personnel regarding the interpretation of both acts as well as related Treasury Board of Canada Secretariat (TBS) policies and guidelines;
• liaising on behalf of the IRB with the TBS, the offices of the Information Commissioner and the Privacy Commissioner as well as other government departments and agencies on a wide variety of ATIP-related issues ranging from legislative interpretation to details of process and procedures;
• providing input into the development of IRB policies and procedures to ensure that they are in compliance with the provisions of both acts;
• coordinating the preparation of the IRB’s Info Source chapter;
• preparing the annual reports to Parliament on the administration of each act; and
• participating in ATIP forums such as the TBS’s ATIP Community meetings and working groups.

The Access to Information and Privacy (ATIP) Unit, which is within the Communications and Access to Information Directorate, is part of the Strategic Directions and Corporate Affairs Branch and is staffed by a manager/coordinator, a supervisor, six ATIP officers and two clerks.

Although section 73.1 of the Privacy Act allows institutions reporting to the same Minister to enter into agreements with each other for the purpose of sharing ATIP resources and capacity, the IRB did not have any such service agreement for the reporting period.

3. Delegation of Authority

Pursuant to section 73(1) of the Act, the deputy head of a government institution may by order designate one or more officers or employees of the institution to exercise or perform any of the powers, duties or functions of the deputy head of the institution.

Authority to exercise the powers and perform the duties and functions of the Chairperson (deputy head) of the IRB for the purposes of the Act has been delegated to the Executive Director, the Director General of the Strategic Directions and Corporate Affairs Branch, the Director of Communications and Access to Information Directorate, the ATIP Manager/Coordinator and the ATIP supervisor.

The Chairperson, the Executive Director, the Departmental Security Officer, the Deputy Departmental Security Officer and the Regional Security Officer are responsible for approving disclosures of personal information deemed to be in the public interest in accordance with paragraph 8(2)(m) of the Act.

A copy of the delegation order is enclosed at Appendix A.

4. Statistical Report on the Privacy Act – Interpretation

The following provides an overview of the statistical information contained in Appendix B of this report.

I. Requests Received:

The IRB received 1,338 formal privacy requests in 2020–21, representing a 36.1 percent decrease in volume from fiscal year 2019–20, during which 2,094 formal requests were submitted. An additional 122 requests were also carried forward from the previous reporting period.

Over the last five years, the number of requests received and completed by the IRB has diminished from year to year. However, the ATIP Directorate is pleased to report that, on average, 3,106 requests were annually received and completed.

II. Disposition of requests completed:

A total of 1,394 formal requests were completed during the 2020–21 reporting period. The completed requests were finalized in the following manner:

Of the 131,859 pages reviewed in response to these requests, 129,633 were released. To compare, 57,000 less pages were reviewed and 48,000 less pages were released in 2020–21 than in the previous fiscal year.

In the 2020–21 fiscal year, a total of 431 requests (30.9 percent) were completely disclosed, 53 requests were disclosed in part (3.8 percent) and 13 requests were abandoned. In regards to these 13 abandoned cases, the applicants either failed to provide sufficient information to allow the IRB to find the requested documentation, or failed to obtain written consent from another individual to authorize the IRB to release the personal information.

In addition, a total of 896 requests (64.3 percent) could not be processed as no relevant records existed. Starting in February 2013, each year the IRB’s ATIP Directorate has received a large volume of privacy requests from individuals in Canada who wish to obtain a letter stating that they have never applied for refugee status in order to travel to India. The Consulate General of India requires that an official letter from the IRB be attached to each application. The letter must indicate whether or not the person made a claim for refugee protection and, if they did, whether this claim was allowed, rejected, withdrawn or abandoned.

III. Exemptions invoked:

Section 2.2 of the statistical report outlines the exemptions that were applied in accordance with the Act. In 2020–21, the IRB relied primarily on the exemptions provided for in the following provision of the Act:

• Section 26 dealing with personal information
• Subsection 22(1) dealing with law enforcement and investigation

It should be noted that if an exemption was applied several times within the same request, it is reported only once in the enclosed statistical report.

IV. Exclusions cited:

Pursuant to sections 69 and 70, this Act does not apply to:

• library or museum material preserved solely for public reference or exhibition purposes;
• materials placed in libraries and museums by or on behalf of persons or organizations other than government institutions; and
• confidences of the Queen’s Privy Council for Canada.

Section 2.3 of the statistical report is reserved for reporting on the number of exclusions applied in accordance with these sections of the Act.

During the 2020–21 reporting period, no exclusions pursuant to sections 69 and 70 of the Act were applied by the IRB.

V. Completion time:

The chart below summarizes the length of time required to process the 1,394 requests completed in 2020–21. Of those requests, 1,123 or 80.6 percent were completed on time.

It should be noted that, at the beginning of the pandemic, the IRB halted all in-person functions in order to protect the health and safety of staff. The impact of that stoppage made it impossible to meet the legal deadline in a total of 266 p​rivacy requests due to the inability to access paper-based records while employees were working from home. If those delayed files were discounted, the processing time for applications would have been in the order of 99.6 percent.

This means that the IRB responded to a total of:

• 1,120 requests in 30 days or less (80%); and
• 274 requests in 31 days or more (20%).

VI. Extensions:

Section 15 of the Act allows government institutions to extend the statutory 30-day time limit for processing a request.

During the 2020–21 reporting period, a total of 53 extensions were taken by the IRB. In 52 cases, the statutory deadline was extended as meeting the original time limit would have unreasonably interfered with the operations of the IRB. In one case, consultation with another government institution was necessary and could not reasonably be completed within the original time limit.

VII. Translation:

There was no request for the translation of records from one official language to the other during the reporting period.

VIII. Method of access:

In 2020–21, access to the records was given in whole or in part in 484 cases. Copies of the requested material were provided in 124 of those cases, while in the other 360 cases, the records were provided electronically.

It should be noted that these figures are based solely on those requests for which information was disclosed.

IX. Corrections and notation

IX. Costs:

In 2020–21, the total costs incurred by the Communications and Access to Information Directorate for the administration of the Act is estimated to be $558,025 all in salaries. The employee resources for this reporting period are estimated at 7.2 FTEs.

X. COVID-19

Because teleworking was a common practice in the ATIP Unit before the pandemic, the exceptional measures to curb COVID-19 implemented by the Government of Canada have had a minimal impact on the IRB’s ability to receive requests as set out in the Privacy Act. Challenges with accessing paper-based records while employees were working from home, however, did result in delays in processing times. In the early days of the pandemic response, this issue resulted in delays for 266 requests. Administrative measures have since been taken to address this issue.

5. Informal Access to Information requests

The IRB processed 28 informal privacy requests during the reporting period. A total of 2688 pages were reviewed and 2500 pages were released to the applicants, representing a 69 percent increase in the number of pages reviewed and 67 percent in the number of pages released compared to the previous reporting period, in which 27 information requests were submitted and where 840 pages were reviewed and of which 825 were released.

6. Consultation Requests

The IRB responded to one consultation request made by other government institutions in 2020–21. A total of five pages were reviewed in response to this consultation, and all pages were recommended for release to the applicant.

7. Complaints and Investigations

In fiscal year 2020–21, three new complaints were filed with the Office of the Privacy Commissioner of Canada against the IRB. This represents 0.2% of all requests received and completed during this same period. Only one complaint was ongoing at year end and is related to non-disclosure of a particular document, which was not accessible by the IRB. This file has since been closed.

No audits were conducted during 2020–21.

8. Monitoring Activities

The manager, in cooperation with the supervisor and analysts, monitors the processing times for privacy requests, on a weekly basis. In addition, ATIP staff periodically perform diagnostic activities related to the processing of the various requests received.

9. Material privacy breaches

During the reporting period, the IRB identified 20 cases of privacy breaches, for which 10 evaluations have been completed. The remaining 10 possible privacy breach are currently being assessed. The Board did not inform the Office of the Privacy Commissioner of Canada because, in all 20 cases, the risk was deemed low and the information was quickly contained.

10. Education and training activities

No formal session was delivered to IRB employees. However, individual and informal training was offered when needed. In addition, the ATIP team is currently working on updating its general ATIP training which will have a portion dealing with privacy breaches.

11. Policies, guidelines and procedures

The IRB implemented the Privacy Implementation Notice 2020-03: Protecting privacy when releasing information about a small number of individuals during the 2020–21 reporting period, to prevent inadvertent identification of individuals from small data sets in highly sensitive contexts (e.g. refugee claims).

12. Privacy impact assessments

The IRB did not complete any Privacy Impact Assessments in 2020–21.

13. Disclosure pursuant to Subsection 8(2) of the Act

In 2020-21, personal information was disclosed in accordance with the following paragraphs of the Act in the number of cases set out in the table below:

14. ​Reading rooms

Individuals who wish to examine records released under the Act can usually contact the Communications and Access to Information Directorate to make arrangements to view release packages at the IRB Headquarters in Ottawa or at one of its regional offices. However, and due to the exceptional measures to curb COVID-19 implemented by the Government of Canada, it has not been possible to do so in 2020-21.

Appendix A - Delegation Orders (Privacy Act)

The Chairperson of the Immigration and Refugee Board of Canada, pursuant to section 73(1) of the Privacy Act, hereby designates the persons holding the positions set out in the schedule below, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Chairperson as the head of the Immigration and Refugee Board of Canada, under the provisions of the Act and related regulations set out in the Schedule opposite each position. This designation replaces all previous delegation orders.

Dated, at the City of Ottawa, this 12th day of January 2021.

Richard Wex, Chairperson

Appendix B - Statistical Report on the Privacy act

Section 1: Requests under the Privacy Act

1.1 Number of requests

Section 2: Requests closed during the reporting period

2.1 Disposition and completion time

2.2 Exemptions

2.3 Exclusions

2.4 Format of information released

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

Relevant pages processed and disclosed by size of requests

2.5.3 Other complexities

2.6 Closed requests

2.6.1 Number of requests closed within legislated timelines

2.7 Deemed refusals

2.7.1 Reasons for not meeting legislated timelines

2.7.2 Requests closed beyond legislated timelines (including any extension taken

2.8 Requests for translation

Section 3: Disclosure under subsections 8(2) and 8(5)

Section 4: Requests for correction of personal information and notations

Section 5: Extensions

5.1 Reasons for extensions and disposition of requests

5.2 Length of extensions

Section 6: Consultations received from other institutions and organizations

6.1 Consultations received from other Government of Canada institutions and organizations

6.2 Recommendations and completion time for consultations received from other Government of Canada institutions

6.3 Recommendations and completion time for consultaitons received from other organizations

Section 7: Completion time of consultations on cabinet confidences

7.1 Requests with Legal Services

7.2 Requests with Privy Council Office

Section 8: Complaints and investigations notices received

Section 9: Privacy Impact Assessments (PIA) and Personal Information Banks (PIB)

9.1 Privacy Impact Assessments

9.2 Personal Information Banks

Section 10: Material privacy breaches

Section 11: Resources related to the Privacy Act

11.1 Costs

11.2 Human Resources

Appendix C - Supplemental Access to Information and Privacy Statistical Form

Section 1: Capacity to receive requests

Section 2: Capacity to process records

2.1 Number of weeks the IRB was able to process paper records in different classification levels:

2.2​ Number of weeks the IRB was able to process electronic records in different classification levels: