2022‑2023 Annual Report on the Privacy Act

Table of Contents

1. Introduction
2. Organizational Structure to Fulfill the Commission’s Privacy Act Responsibilities
3. Delegation Order
4. Performance 2022-23
5. Training and Awareness
6. Policies, Guidelines and Procedures
7. Initiatives and Projects to Improve Privacy
8. Complaints, Audits, and Investigations
9. Privacy Breaches
10. Privacy Impact Assessments
11. Disclosure
12. Monitoring

1. Introduction

The Military Police Complaints Commission of Canada (the Commission) is pleased to submit to Parliament its Annual Report on the administration of the Privacy Act for its fiscal year 2022‑23 (April 1, 2022 to March 31, 2023). This report was prepared and tabled in accordance with section 72 of the Privacy Act.

The purpose of the Privacy Act is to provide:

• individuals with the right to access and correct personal information about themselves that is under the control of a government institution; and
• the legal framework for the collection, retention, use, disclosure, disposition and accuracy of personal information in the administration of programs and activities by government institutions subject to the act.

Under the Privacy Act, personal information is defined as “information about an identifiable individual that is recorded in any form.”

Examples include information relating to:

• the national or ethnic origin, colour, religion, age or marital status of an individual;
• the education or the medical, criminal, financial or employment history of an individual;
• the address, fingerprints or blood type of an individual; and
• any identifying number, symbol or other particular identifier assigned to an individual.

The Commission is a civilian, quasi-judicial oversight agency that operates at arm’s length from the Government of Canada. As a federal institution, it is part of the Defence portfolio for reporting purposes.

The Commission reviews and investigates complaints concerning Military Police conduct and investigates allegations of interference in Military Police investigations. The Commission also makes recommendations and reports its findings directly to the Military Police and National Defence leadership.

The mission of the Commission is to:

• promote and ensure the highest standards of conduct of Military Police in the performance of policing duties; and
• discourage interference in any Military Police investigation.

2. Organizational Structure to Fulfill the Commission’s Privacy Act Responsibilities

The Commission is a micro-organization of 28 employees. To fulfil its Privacy Act requirements, privacy protection is a shared responsibility; however, the Access to Information and Privacy (ATIP) mandate resides with the Corporate Services Sector.

The Senior Director, Corporate Services, is identified as the Commission’s ATIP Coordinator. He is supported by both the Manager of Corporate Reporting, ATIP and Administration and the Administrative Services Officer who each dedicate an average of 10% of their time to fulfil the Commission’s obligations under both the Access to Information Act and the Privacy Act. The Commission also hires one ATIP consultant, as required.

The ATIP coordinator is responsible for implementing and managing programs and services relating to the Commission’s administration of the Access to Information Act and the Privacy Act, as well as for providing advice to its employees as they fulfil their obligations under both Acts.

Responding to Privacy Act requests is a shared responsibility between the delegated request processing team and the Offices of Primary Interest.

The main activities involved in processing Privacy Act requests are as follows:

• Analyze purpose/history of requests, interpret legislation, and determine information that may be disclosed, exempted or excluded.
• Provide advice and consultation to requesters, third-party stakeholders and the Commission’s management and employees, respond to questions and concerns, ensure that they have a clear understanding of legislation the Commission policies and procedures for handling requests and other Privacy Act related issues, including document security classification.
• Conduct research and consultations with other departments and third parties to prepare responses to requests.
• Provide recommendations for the preparation of evidence to be disclosed during a Public Interest Hearing in accordance with Privacy Act legislation, Open Court Principles and other related policies and procedures.
• Prepare reports for the Commission’s management on Privacy Act requests and other Privacy Act related matters, including statistical reports, Annual Reports for submission to Parliament and information required by Info Source.

The Commission did not provide services related to privacy to other government institutions and was not a party to any services agreements with other government institutions under section 73.1 of the Privacy Act.

3. Delegation Order

Pursuant to section 73 of the Privacy Act, the Chairperson has delegated certain of her powers, duties and functions under the Privacy Act and Regulations to the Senior Director Corporate Services, the Manager of Corporate Reporting, ATIP and Administration and the Administrative Services Officer. A copy of the delegation order can be found in Appendix A. The Delegation Order in effect on March 31, 2023, found in Appendix A was signed in May 2019.

4. Performance 2022-23

During this review period, the Commission completed 14 Privacy Act requests which represents 2 326 pages processed: 1 request was entirely disclosed, 1 request was disclosed in part, 2 requests were transferred to another government department and 10 were requests for which no records existed.

The Commission responded to 13 of the Privacy Act requests within the legislated 30-day timeline. 1 request was the subject of a 30-day extension and was responded to within the legislated 60-day timeline.

The graphic below shows, for 2018‑19 to 2022‑23, the numbers of Privacy Requests the Commission completed each year. No Privacy Requests were received by the Commission in 2018‑19. The Commission received only 5 Privacy Requests in 2019-20. The Commission received only 10 requests in 2020‑21. This number increased significantly during the current reporting period 2021-22 but decreased slightly in 2022‑23. We have seen an increase in requests over the past three years since the launch of the centralized ATIP portal.

To note, most of the requests received are intended for the Department of National Defence, to access Military Police documents, but are mistakenly submitted to us.

The Commission’s ability to fulfil its Privacy Act obligations and responsibilities during this reporting period were not affected by COVID‑19. Therefore, no specific measures were implemented relating to COVID‑19.

One application was the subject of a 30-day extension request under Section 15 of the Privacy Act and was processed within the 60-day legislated timeline. This request included time-limited exemptions due to an ongoing investigative process.

The Commission did not receive any consultation requests from other government institutions.

For additional information, please refer to Appendix B and Appendix C.

5. Training and Awareness

The Commission’s learning directive requires that all new employees complete 2 mandatory online courses related to Access to Information and Privacy knowledge about properly process requests and protect personal information through the Canada School of Public Service portal i.e., Fundamentals of Information Management (COR501) and Access to Information and Privacy Fundamentals (COR502). A training session was also held for all employees of the Commission in May 2022. The new Chairperson was briefed on her accountability regarding the Privacy Act as part of her onboarding in January 2023.

6. Policies, Guidelines and Procedures

In July 2022, the Government of Canada launched a new version of the ATIP Online Request System Portal. This new version allows requesters to submit their Access to Information and Privacy requests and view their progress directly through the Portal. The Commission began receiving requests from this new Portal in mid-July 2022 and consequently adjusted its internal procedures accordingly. Rather than receiving an email to the Commission’s ATIP mailbox, the Commission’s ATIP team members must now view and update the status of the requests directly in the Portal.

7. Initiatives and Projects to Improve Privacy

The following internal initiatives to improve Privacy were implemented during the reporting period:

• Revision and modification of internal procedures for processing ATIP requests following the implementation of the ATIP Portal - Summer 2022;
• Collaboration with Department of National Defence to review and modify the Commission’s request transfer procedures - Fall 2022;
• Modification of procedures for responding to NIL requests - December 2022

8. Complaints, Audits, and Investigations

Over the period covered by this report, no complaints were filed against the Commission with the Office of the Privacy Commissioner of Canada, no audits were conducted and no appeals concerning privacy requests were filed in Federal Court.

9. Privacy Breaches

No material privacy breach occurred at the Commission during the reporting period.

10. Privacy Impact Assessments

No Privacy Impact Assessments were completed during the reporting period.

11. Disclosure

The Commission has not disclosed any personal information pursuant to subsection 8(2)(m) of the Privacy Act.

12. Monitoring

Given the size of the organization and the limited number of requests received annually, no formal audit was conducted during the reporting period. However, from the receipt to the closure of all Privacy requests, the Commission monitors processing times by promptly entering all actions and activities in its internal ATIP status report (which includes both Access to Information and Privacy requests). Legislated timelines are also carefully entered into the report to prevent any delays in the processing of the requests received and to ensure that requests are dealt with in a timely manner.

Throughout the year, the Senior Director of Corporate Services/ATIP Coordinator submits the ATIP Status reports to the Executive Committee as an information item on their meeting agendas. These also include draft Access to Information Act and Privacy Act Annual Reports and Statistical Reports. The Executive Committee consists of the Chairperson (Deputy Head), the Senior General Counsel and Director General, the Senior Director Corporate Services/ATIP Coordinator and the General Counsel and Senior Director of Operations.

Appendix A – Privacy Act Delegation Order

Appendix B – 2022‑23 Statistical Report on the Privacy Act

Name of institution: Military Police Complaints Commission of Canada

Reporting Period: 2022‑04‑01 to 2023‑03‑31

Section 3: Requests Closed During the Reporting Period

Section 4: Diclosures Under Subsections 8(2) and 8(5)

Section 5: Requests for Correction of Personal Information and Notations

Section 6: Extensions

Section 7: Consultations Received From Other Institutions and Organizations

Section 8: Completion Time of Consultations on Cabinet Confidences

Section 9: Complaints and Investigations Notices Received

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

Section 11: Privacy Breaches