Annual Report on the Privacy Act 2024–25

Date of Publishing:
November 6, 2025

Download PDF (opens in a new tab)

Introduction

The Privacy Act (PA) gives individuals the right of access to information about themselves that is under the control of a government institution, subject to certain specific and limited exemptions and exclusions. The PA also protects the privacy of individuals by giving them substantial control over the collection, use and disclosure of their personal information, and by preventing others from having access to that information.

Section 72 of the Privacy Act requires the head of each government institution to prepare an annual report on the administration of the PA within the institution that is to be tabled in both Houses of Parliament.

This report to Parliament, which is prepared and tabled pursuant to section 72 of the Privacy Act, describes the activities of the National Security and Intelligence Review Agency Secretariat (the Secretariat) in administering the Privacy Act during the period of April 1, 2024, to March 31, 2025 (the reporting period).

If you require more information or wish to make a request under the Privacy Act or the Access to Information Act, please direct your inquiries to the following:

Access to Information and Privacy Office
National Security and Intelligence Review Agency Secretariat
P.O. Box 2430, Station "D"
Ottawa, Ontario K1P 5W5
Canada

Phone : 1-833-890-0293
Email : ATIP@nsira-ossnr.gc.ca

Who We Are

Established in July 2019, the National Security and Intelligence Review Agency (NSIRA) is an independent agency that reports to Parliament and conducts investigations and reviews of the federal government’s national security and intelligence activities.

The Secretariat assists NSIRA in fulfilling its mandate. It is the Secretariat, headed by an Executive Director, that is the government institution for the purposes of the Privacy Act and the Access to Information Act (ATIA).

Mandate

NSIRA has a dual mandate to conduct reviews and investigations in relation to Canada’s national security or intelligence activities.

Reviews

NSIRA’s review mandate is broad, as outlined in subsection 8(1) of the National Security and Intelligence Review Agency Act (NSIRA Act). This mandate includes reviewing the activities of both the Canadian Security Intelligence Service (CSIS) and the Communications Security Establishment (CSE), as well as the national security- or intelligence-related activities of any other federal department or agency. This includes, but is not limited to, the national security or intelligence activities of the Royal Canadian Mounted Police (RCMP), the Canada Border Services Agency (CBSA), the Department of National Defence (DND) and Canadian Armed Forces (CAF), Global Affairs Canada (GAC), and the Department of Justice. Further, NSIRA may review any national security or intelligence matters that a minister of the Crown refers to NSIRA.

NSIRA reviews assess whether Canada’s national security and intelligence activities comply with relevant laws, policies, and ministerial directions, and whether they are reasonable and necessary. In conducting its reviews, NSIRA can make any findings or recommendations it considers appropriate.

Investigations

NSIRA is responsible for investigating national security or intelligence-related complaints from members of the public. As outlined in paragraph 8(1)(d) of the NSIRA Act, NSIRA has the mandate to investigate complaints about:

• any activity of CSIS or of CSE;
• decisions to deny or revoke certain federal government security clearances;
• any complaint referred under subsection 45.53(4.1) or 45.67(2.1) of the Royal Canadian Mounted Police Act;
• reports made under section 19 of the Citizenship Act; and
• matters referred under section 45 of the Canadian Human Rights Act.

Organizational Structure

The Secretariat’s ATIP Office is accountable for the development and implementation of effective policies, guidelines, and procedures to ensure that the Secretariat meets its responsibilities under the PA and the ATIA. Since the last reporting period, the ATIP Office added and reclassified new personnel to assist with new policies implementation to comply with statutory requirements and increase of access requests to comply with statutory requirements under the PA and the ATIA.

For the reporting period, the Secretariat’s ATIP Office consisted of:

• One (1) full-time Director, in addition to fulfilling normal duties as Director of Communications and Administrative Services for the Secretariat and NSIRA Members;
• One (1) full-time ATIP Senior Advisor;
• One (1) full-time ATIP Coordinator;
• One (1) part-time ATIP Student;
• Two (2) part-time ATIP Consultants; and
• When required, the ATIP Office was supported by one (1) full-time Senior Counsel, Internal Services.

The Secretariat’s ATIP Office is responsible for the following:

• monitoring compliance with ATIP legislation and relevant procedures and policies;
• processing requests under both the Privacy Act and the Access to Information Act;
• developing and maintaining policies, procedures, and guidelines to ensure that the Secretariat respected the Privacy Act and the Access to Information Act;
• maintaining Personal Information Banks and conducting privacy impact assessments;
• preparing annual reports to Parliament and other statutory reports, as well as other material that might be required by central agencies; and
• representing the Secretariat in dealings with the Treasury Board of Canada Secretariat, the information and privacy commissioners, and other government departments and agencies in matters pertaining to the Privacy Act and the Access to Information Act.

During the reporting period, the Secretariat was party to a service agreement under section 73.1 of the Privacy Act in which the Secretariat received administrative support from the Privy Council Office related to the tabling of this annual report in Parliament. The Secretariat was also party to a service agreement under section 71.1 of the Privacy Act, in which the Secretariat received ATIP Online services from the Treasury Board of Canada Secretariat.

To assist the Secretariat’s ATIP Office in meeting its overall legislative obligations, the Secretariat relied on a collaborative internal group of subject matter experts from all divisions.

Delegation Order

As the Head of the Secretariat, the Executive Director is responsible for the administration of the PA within the institution. Pursuant to section 73 of the PA, the Executive Director has delegated the ATIP Director, the ATIP Senior Advisor, the ATIP Coordinator, as well as individuals acting in these positions to perform certain and specific powers, duties, and functions for the administration of the PA. These positions have limited delegation of authority under the PA and the Access to Information Act, in accordance with the delegation of authority instrument approved by the Executive Director in October 2024. A copy of the Delegation Order can be found in Annex A.

Performance 2024-2025

Performance in Processing Privacy Requests

During the reporting period from April 1, 2024, to March 31, 2025, the Secretariat received 23 formal access to information requests, in addition to 3 requests carried over from the previous reporting period, for a total of 26 requests. Of these, the ATIP Office closed 18 requests and processed approximately 203 pages. Eight (8) requests were carried over into the next reporting period, all of which remained within the legislated timelines.

Statistical Reports for 2024-2025

The Secretariat’s 2024-2025 Statistical Report on the Privacy Act and Supplemental ATIP Statistical Report for 2024-2025 were both validated by the Treasury Board Secretariat in July 2025.

Extensions

During the reporting period, the ATIP Office invoked an extension while processing one (1) request under paragraph 15(a)(ii) of the Privacy Act within 0 to 15 days. Invoking extensions on this request was necessary to accurately review a significant amount of records received for this request.

Completion Time of Completed Requests

Of the 18 requests completed during the reporting period:

• 1 request, or 5.5% of the requests completed, was disclosed in part. This request was completed within 31 to 60 days;
• 10 requests, or 55.5% of the requests completed, were neither confirmed or denied. 5 requests were completed within 0 to 15 days, and 5 requests were completed within 16 to 30 days;
• 6 requests, or 33.3% of the requests completed, resulted in no records. 4 requests were completed within 16 to 30 days, and 2 requests completed within 31 to 60 days; and
• 1 request, or 5.5% of the requests completed, was abandoned. This request was completed within 31 to 60 days.

During the reporting period, the on-time response rate increased to 83.3% from 56% from the 2023-2024 reporting period.

Consultations

During the reporting period, the ATIP Office received one (1) consultation request from another government department, consisting of 2 pages. This one (1) consultation request was completed within 0 to 15 days.

Complaints and Investigations

Subsection 29(1) of the PA describes how the Office of the Privacy Commissioner (OPC) receives and investigates complaints from individuals regarding the processing of requests under the PA. During the reporting period, the Secretariat’s ATIP Office was the subject of one new complaint, and one report of findings from the OPC, which determined that the complaint was “not well founded”. Additionally, we also received eight reports of findings and recommendations from complaints from previous reporting periods.

Training and Awareness

The Secretariat took a customized approach to training subject matter experts on their legislative requirements, roles, and responsibilities. The Secretariat’s ATIP Office encouraged employees to take the ATIP training courses offered by the Canada School of Public Service. New employees were required to complete an online training session entitled Fundamentals of Access to Information and Privacy within six months of joining the Secretariat and in November 2024, an internal ATIP training session was held.

To ensure in-depth training is taken by employees of the NSIRA Secretariat who have functional or delegated responsibility for the administration of the PA and Privacy Regulations, the Senior ATIP Advisor attended the 2024 Canadian Access and Privacy Association Conference, while the ATIP Director attended the International Association of Privacy Professionals Global Privacy Summit 2024.

Policies, Guidelines, and Procedures

During the reporting period, the Secretariat’s ATIP Office advanced several initiatives to enhance its efficiency. Notably, it finalized key documents including the Privacy Breach Plan and Procedures Manual, and the Privacy Protocol Template. In addition, the Secretariat established a formal Privacy Impact Assessment policy to strengthen privacy governance and compliance.

Initiatives and Projects to Improve Privacy

During the reporting period, the Secretariat did not implement or continue any new initiatives or projects related to privacy.

Summary of Key Issues and Actions Taken on Complaints

During the reporting period, the Secretariat’s ATIP Office engaged meaningfully with the Office of the Privacy Commissioner on 10 active complaints. One complaint was received during this reporting period, while the remaining nine were carried over from previous periods. All complaints were resolved, and reports of findings were issued by the OPC, each concluding that the complaints were “not well founded.” Additionally, the Secretariat received one recommendation related to its Privacy Impact Assessment, which was finalized and fully implemented.

Material Privacy Breaches

During the reporting period, no material privacy breaches occurred.

Privacy Impact Assessments

During the reporting period, the Secretariat’s ATIP Office modified one (1) Privacy Impact Assessment related to the creation of the National Security and Intelligence Review Agency. The updated assessment web summary can be accessed here.

Public Interest Disclosures

During the reporting period, no public interest disclosures occurred.

Monitoring Compliance

Legislative deadlines for privacy requests were closely monitored through the use of multiple Microsoft Lists trackers. In collaboration with the ATIP Senior Advisor, the ATIP Director organized ad hoc meetings to review request-related activities, set deadlines, and ensure that all relevant personnel within the ATIP Office and, when applicable, across the Secretariat were informed of the status of requests. Additionally, the ATIP Office held weekly meetings to strategize on meeting upcoming deadlines and to ensure accurate administration of statutory requirements and policy instruments. Compliance with legislative and policy obligations was also regularly raised and discussed by the ATIP Director during bi-weekly team meetings with the Secretariat’s Executive Director (Deputy Head) and the Senior Counsel, Internal Services.

Appendices

Appendix A: Delegation Order

Privacy Act Designation Order

The Executive Director of the National Security and Intelligence Review Agency, pursuant to section 73 of the Privacy Act*, hereby designates the persons holding the positions or acting in these positions, set out in the schedule hereto to exercise the powers and perform the duties and functions of the Executive Director of the National Security and Intelligence Review Agency as the head of a government institution under the section of the Privacy Act set out in the schedule opposite each position.

Appendix B: 2024–2025 Statistical Report on the Privacy Act

Name of institution: National Security and Intelligence Review Agency

Reporting period: 2024-04-01 – 2025-03-31

Section 1: Request Under the Privacy Act

1.1 Number of Requests

1.2 Channels of requests

Section 2: Informal requests

2.1 Number of informal requests

2.2 Channels of informal requests

2.3 Completion time of informal requests

2.4 Pages released informally

Section 3: Requests Closed During the Reporting Period

3.1 Disposition and completion time

3.2 Exemptions

3.3 Exclusions

3.4 Format of information released

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper and e-record formats

3.5.2 Relevant pages processed per request disposition for paper, e-record and dataset formats by size of requests

3.5.3 Relevant minutes processed and disclosed for audio formats

3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests

3.5.5 Relevant minutes processed and disclosed for video formats

3.5.6 Relevant minutes processed per request disposition for video formats by size of requests

3.5.7 Other complexities

3.6 Closed requests

3.6.1 Requests closed within legislated timelines

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines

3.7.2 Requests closed beyond legislated timelines (including any extension taken)

3.8 Requests for translation

Section 4: Disclosures Under Subsections 8(2) and 8(5)

Section 5: Requests for Correction of Personal Information and Notations

Section 6: Extensions

6.1 Reasons for extensions and disposition of requests

6.2 Length of extensions

Section 7: Consultations Received From Other Institutions and Organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada

Section 8: Completion Time of Consultations on Cabinet Confidences

8.1 Requests with Legal Services

8.2 Requests with Privy Council Office

Section 9: Complaints and Investigations Notices Received

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBS)

10.1 Privacy Impact Assessments

10.2 Institution-specific and Central Personal Information Banks

Section 11: Privacy Breaches

11.1 Material Privacy Breaches reported

11.2 Non-Material Privacy Breaches

Section 12: Resources Related to the Privacy Act

12.1 Allocated Costs

12.2 Human Resources

Note: Enter values to three decimal places.

Annex C: Supplemental Statistical Report

Section 1: Requests Carried Over and Active Complaints Under the Access to Information Act

1.1 Requests carried over to next reporting period, broken down by reporting period received

1.2 Active complaints with the Information Commissioner of Canada, broken down by reporting period received

Section 2: Requests Carried Over and Active Complaints Under the Privacy Act

2.1 Requests carried over to next reporting period, broken down by reporting period received

2.2 Active complaints with the Privacy Commissioner of Canada, broken down by reporting period received

Section 3: Social Insurance Number

Section 4: Universal Access under the Privacy Act