Annual Report on the Privacy Act 2022–23

Date of Publishing:
October 17, 2023

Download PDF (opens in a new tab)

Introduction

The Privacy Act gives individuals the right to access information about themselves that is held by the National Security and Intelligence Review Agency Secretariat, subject to certain specific and limited exceptions. The Privacy Act also protects the privacy of individuals by giving them substantial control over the collection, use, and disclosure of their personal information and by preventing others from having access to that information.

Section 72 of the act requires the head of each government institution to prepare an annual report on the administration of the act within the institution and to submit the report to Parliament.

This report to Parliament, which is prepared and tabled in accordance with section 72 of the Privacy Act, describes the activities of the National Security and Intelligence Review Agency Secretariat in administering the Act during the period of April 1, 2022 to March 31, 2023.

If you require more information or wish to make a request under the Access to Information Act or the Privacy Act, please direct your inquiries to the following:

Access to Information and Privacy Office
National Security and Intelligence Review Agency Secretariat
P.O. Box 2430, Station "D"
Ottawa, Ontario K1P 5W5
Canada

Phone : 1-833-890-0293
Email : ATIP@nsira-ossnr.gc.ca

Who we are

Established in July 2019, NSIRA is an independent agency that reports to Parliament and conducts investigations and reviews of the federal government’s national security and intelligence activities.

The NSIRA Secretariat assists NSIRA in fulfilling its mandate. It is the NSIRA Secretariat, headed by an Executive Director, that is the government institution for the purposes of the Privacy Act and the Access to Information Act.

Mandate

The NSIRA Secretariat supports NSIRA in its dual mandate to conduct reviews and investigations in relation to Canada’s national security or intelligence activities.

Reviews

NSIRA’s review mandate is broad, as outlined in subsection 8(1) of the National Security and Intelligence Review Agency Act (NSIRA Act). This mandate includes reviewing the activities of both the Canadian Security Intelligence Service (CSIS) and the Communications Security Establishment (CSE), as well as the national security- or intelligence-related activities of any other federal department or agency. This includes, but is not limited to, the national security or intelligence activities of the Royal Canadian Mounted Police (RCMP), the Canada Border Services Agency (CBSA), the Department of National Defence (DND) and Canadian Armed Forces (CAF), Global Affairs Canada (GAC), and the Department of Justice. Further, NSIRA may review any national security or intelligence matters that a minister of the Crown refers to NSIRA.

NSIRA reviews assess whether Canada’s national security and intelligence activities comply with relevant laws, policies, and ministerial directions, and whether they are reasonable and necessary. In conducting its reviews, NSIRA can make any findings or recommendations it considers appropriate.

Investigations

NSIRA is responsible for investigating national security or intelligence-related complaints from members of the public. As outlined in paragraph 8(1)(d) of the NSIRA Act, NSIRA has the mandate to investigate complaints about:

• any activity of CSIS or of CSE;
• decisions to deny or revoke certain federal government security clearances;
• any complaint referred under subsection 45.53(4.1) or 45.67(2.1) of the Royal Canadian Mounted Police Act,
• reports made under section 19 of the Citizenship Act, and
• matters referred under section 45 of the Canadian Human Rights Act.

Access to Information and Privacy Office – Organizational Structure

NSIRA’s ATIP Office is accountable for the development and implementation of effective policies, guidelines, systems, and procedures to ensure that the NSIRA Secretariat meets its responsibilities under the Access to Information Act and the Privacy Act. For the reporting period, the NSIRA ATIP office consisted of:

• 1 Full-time Access to Information Consultant;
• 1 Part-time Privacy Consultant; and
• 1 Full-time ATIP Manager who fulfilled the duties that would normally be carried out by an ATIP Coordinator, as well as managed the ATIP Office in addition to fulfilling normal duties as Manager of Administrative Services for the Secretariat and Agency Members.

NSIRA Secretariat Senior General Counsel and Corporate Counsel supported the ATIP Office on an as required basis.

The ATIP Office is responsible for the following:

• monitoring compliance with ATIP legislation and relevant procedures and policies;
• processing requests under both the Access to Information Act and the Privacy Act;
• developing and maintaining policies, procedures, and guidelines to ensure that the NSIRA Secretariat respected the Access to Information Act and the Privacy Act;
• maintaining Personal Information Banks and conducting privacy impact assessments;
• preparing annual reports to Parliament and other statutory reports, as well as other material that might be required by central agencies; and
• representing the NSIRA Secretariat in dealings with the Treasury Board of Canada Secretariat, the information and privacy commissioners, and other government departments and agencies in matters pertaining to the Access to Information Act and the Privacy Act.

The NSIRA Secretariat was a party to a service agreement under section 73.1 of the Privacy Act during the reporting period, pursuant to which it received administrative services from the Privy Council Office related to the tabling of the Privacy Act annual report in Parliament. The NSIRA Secretariat was also a party to a service agreement under section 71.1 of the Act, pursuant to which it received ATIP Online services from the Treasury Board of Canada Secretariat.

To assist the ATIP Office in meeting its overall legislative obligations, the NSIRA Secretariat relied on a collaborative internal group of subject matter points of contact from all its branches.

Delegation Order

The Executive Director, as the Head of the NSIRA Secretariat, is responsible for the administration of the Privacy Act within the institution. Pursuant to section 73 of the Privacy Act, the Executive Director has delegated the ATIP Manager and ATIP Officer – as well as persons acting in these positions – to perform powers, duties, and functions for the administration of the Act. These positions have limited delegation of authority under the Act and the Access to Information Act, in accordance with the delegation of authority instrument approved by the Executive Director in August 2022. The Privacy Act Delegation Order can be found in Appendix A.

Performance 2022-2023

Performance in Processing Privacy Requests

During the reporting period, from April 1, 2022 to March 31, 2023, the NSIRA Secretariat received 12 formal requests. All 12 requests were completed during the reporting period. No requests were carried over from the previous reporting period.

Statistical Reports for 2022-2023

The institution’s 2022-2023 Statistical Report on the Privacy Act and Supplemental ATIP Statistical Report for 2022-2023 are found in Appendices B and C.

Extensions and Completion Time of Closed Requests

During the reporting period, the NSIRA Secretariat invoked extensions in processing 5 requests: 3 extensions of 31 to 60 days, and 2 extensions of 61 to 120 days, all of which included extensions necessary to consult with third parties.

Of the requests completed during the reporting period:

• 1 request, or 8.33% of the requests completed, was disclosed in its entirety. This request was completed within 16 to 30 days.
• 4 requests, or 33.33% of the requests completed, were disclosed in part. 1 request completed within 16 to 30 days, 2 requests completed within 31 to 60 days, and 1 request completed within 61 to 120 days.
• 7 requests, or 58.33% of the requests completed, resulted in no records. 1 request completed within 1 to 15 days, 4 requests completed within 16 to 30 days, 1 request completed within 31 to 60 days, and 1 request completed within 61 to 120 days.

The NSIRA Secretariat’s responses to many requests required intensive review of complex records, including extensive internal and external consultations. In 2022-23, the NSIRA Secretariat’s on-time response rate decreased to 58.33% from 71% in the previous reporting year.

Consultations

No consultations were received by the NSIRA Secretariat during the reporting period.

Impact of COVID-19 Measures

During the reporting period, the NSIRA Secretariat was not affected by measures related to the COVID‑19 pandemic.

Complaints and Investigations

During the reporting period, the NSIRA Secretariat received 9 privacy complaints, 2 of which were related to access. All 9 complaints remained active on March 31, 2023.

Moreover, one privacy breach-related investigation initiated by the Privacy Commissioner in fiscal year 2020-2021 continued during the reporting period and remained active on March 31, 2023.

Training and Awareness

During the reporting period, privacy training requirements were identified for all NSIRA Secretariat employees, as well as for those with functional or delegated responsibility for the administration of the Privacy Act, in accordance with the Directive on Personal Information Requests and Correction of Personal Information. The Canada School of Public Service course Access to Information and Privacy Fundamentals (COR502) was included as mandatory training in all employees’ training curriculum.

In addition, an all-staff lunch and learn session was held in August 2022 to provide employees with a debrief of the International Association of Privacy Professionals Privacy Conference.

Policies, Guidelines, and Procedures

The NSIRA Secretariat updated the Delegation Order during the reporting period and also established its internal Directive on Managing Security and Safety Events in March 2023, which provides for coordination with the ATIP Office and Office of Primary Interest when a security event involves a suspected or actual privacy breach.

Initiatives and Projects to Improve Privacy

The NSIRA Secretariat’s IT team began work to develop an ATIP software tool for our classified and unclassified systems. The NSIRA Secretariat also signed a memorandum of understanding with TBS to make full use of ATIP Online and implemented the tool during the reporting period.

Summary of Key Issues and Actions Taken on Complaints

As previously outlined, all 9 complaints received during the reporting period remained active on March 31, 2023. The NSIRA Secretariat meaningfully engaged with the Office of the Privacy Commissioner on all active investigations and disclosed additional records in 1 of the 2 access-related complaints.

Material Privacy Breaches

In the 2022-2023 reporting period, no material privacy breaches occurred.

Privacy Impact Assessments

The NSIRA Secretariat did not complete any PIAs in 2022-2023. During the reporting period, the NSIRA Secretariat received feedback from TBS for its PIA on the creation of NSIRA — which had been submitted to TBS in FY 2021-2022 — and undertook revisions to the PIA. During the reporting period, the NSIRA Secretariat also launched a PIA exercise pertaining to its investigations-related activities.

Public Interest Disclosures

No disclosures were made pursuant to paragraph 8(2)(m) of the Privacy Act during the reporting period.

Monitoring Compliance

In order to meet the legislative deadlines for privacy requests, deadlines for individual requests are strictly monitored by using MS Outlook reminders. The ATIP Manager organizes ad hoc meetings to discuss request-related activities (such as whether inter-institutional consultations are necessary), determine deadlines and ensure that all team members are informed of the status of files. At bi-weekly team meetings with the Senior General Counsel and Corporate Counsel, the ATIP Manager raises and discusses compliance with legislative and policy obligations. The Executive Director is also briefed on all ATIP compliance issues.

For contracts issued during the reporting period, the NSIRA Secretariat included a Standard Procurement Clause on the Handling of Personal Information or a Supplemental General Condition on Personal Information from Public Services and Procurement Canada’s Standard Acquisition Clauses and Conditions Manual.

Appendices

Appendix A: Delegation Order

Access to Information Act Designation Order

The Executive Director of the National Security and Intelligence Review Agency, pursuant to section 95 of the Access to Information Act, hereby designates the persons holding the positions or acting in these positions, set out in the schedule hereto to exercise the powers and perform the duties and functions of the Executive Director of the National Security and Intelligence Review Agency as the head of a government institution under the section of the Access to Information Act set out in the schedule opposite each position.

Privacy Act Designation Order

The Executive Director of the National Security and Intelligence Review Agency, pursuant to section 73 of the Privacy Act*, hereby designates the persons holding the positions or acting in these positions, set out in the schedule hereto to exercise the powers and perform the duties and functions of the Executive Director of the National Security and Intelligence Review Agency as the head of a government institution under the section of the Privacy Act set out in the schedule opposite each position.

Appendix B: 2022-2023 Statistical Report on the Privacy Act

Name of institution: National Security and Intelligence Review Agency

Reporting period: 2022-04-01 – 2023-03-31

Section 1: Request Under the Privacy Act

1.1 Number of Requests

1.2 Channels of requests

Section 2: Informal requests

2.1 Number of informal requests

2.2 Channels of informal requests

2.3 Completion time of informal requests

2.4 Pages released informally

Section 3: Requests Closed During the Reporting Period

3.1 Disposition and completion time

3.2 Exemptions

3.3 Exclusions

3.4 Format of information released

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper and e-record formats

3.5.2 Relevant pages processed per request disposition for paper and e-record formats by size of requests

3.5.3 Relevant minutes processed and disclosed for audio formats

3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests

3.5.5 Relevant minutes processed and disclosed for video formats

3.5.6 Relevant minutes processed per request disposition for video formats by size of requests

3.5.7 Other complexities

3.6 Closed requests

3.6.1 Requests closed within legislated timelines

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines

3.7.2 Requests closed beyond legislated timelines (including any extension taken)

3.8 Requests for translation

Section 4: Disclosures Under Subsections 8(2) and 8(5)

Section 5: Requests for Correction of Personal Information and Notations

Section 6: Extensions

6.1 Reasons for extensions and disposition of requests

6.2 Length of extensions

Section 7: Consultations Received From Other Institutions and Organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada

Section 8: Completion Time of Consultations on Cabinet Confidences

8.1 Requests with Legal Services

8.2 Requests with Privy Council Office

Section 9: Complaints and Investigations Notices Received

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBS)

10.1 Privacy Impact Assessments

10.2 Institution-specific and Central Personal Information Banks

Section 11: Privacy Breaches

11.1 Material Privacy Breaches reported

11.2 Non-Material Privacy Breaches

Section 12: Resources Related to the Privacy Act

12.1 Allocated Costs

12.2 Human Resources

Note: Enter values to three decimal places.

Appendix C: Supplemental Statistical Report on the Access to Information Act and Privacy Act

Section 1: Capacity to Receive Requests under the Access to Information Act and the Privacy Act

Section 2: Capacity to Process Records under the Access to Information Act and the Privacy Act

2.1 Number of weeks your institution was able to process paper records in different classification levels

2.2 Number of weeks your institution was able to process electronic records in different classification levels

Section 3: Open Requests and Complaints Under the Privacy Act

3.1 Number of open requests that are outstanding from previous reporting periods.

3.2 Number of open complaints with the Privacy Commissioner of Canada that are outstanding from previous reporting periods.

Section 4: Social Insurance Number

Section 5: Universal Access under the Privacy Act