2023‑2024 Annual Report on the Privacy Act

1. Introduction

The Military Police Complaints Commission of Canada (the Commission) is pleased to submit to Parliament its Annual Report on the administration of the Privacy Act for its fiscal year 2023-24 (April 1, 2023 to March 31, 2024). This report was prepared and tabled in accordance with section 72 of the Privacy Act.

The purpose of the Privacy Act is to provide:

• individuals with the right to access and correct personal information about themselves that is under the control of a government institution; and
• the legal framework for the collection, retention, use, disclosure, disposition and accuracy of personal information in the administration of programs and activities by government institutions subject to the act.

Under the Privacy Act, personal information is defined as “information about an identifiable individual that is recorded in any form.”

Examples include information relating to:

• the race, national or ethnic origin, colour, religion, age or marital status of an individual;
• the education or the medical, criminal, financial or employment history of an individual;
• the address, fingerprints or blood type of an individual; and
• any identifying number, symbol or other particular identifier assigned to an individual.

The Commission is an administrative tribunal created by Parliament to provide independent, civilian oversight of the Canadian Forces Military Police. As a federal institution, it is part of the Defence portfolio for reporting purposes.

The Commission's mandate is set out in Part IV of the National Defence Act, which provides the following powers:

• monitoring investigations by the Canadian Forces Provost Marshal of military police conduct complaints;
• reviewing disposition of conduct complaints about military police members, at the request of complainants;
• investigating complaints of interference made by military police members;
• conducting public interest investigations and hearings;
• reporting findings and making recommendations to the military police and national defence leadership.

The mission of the Commission is to promote and ensure the highest standards of conduct by the military police, to deter interference in military police investigations and to enhance public confidence in military policing.

The Commission did not have any non-operational (“paper”) subsidiaries to report during this review period.

Finally, the Commission has submitted and tabled its reports to Parliament.

2. Organizational Structure to Fulfill the Commission’s Privacy Act Responsibilities

The Commission is a micro-organization of 31 employees. To fulfil its Privacy Act requirements, privacy protection is a shared responsibility; however, the Access to Information and Privacy (ATIP) mandate resides with the Corporate Services Sector.

The Senior Director, Corporate Services, is identified as the Commission’s ATIP Coordinator. He is supported by both the Manager of Corporate Reporting, ATIP and Administration and the Administrative Services Officer which in total dedicate an average of 10.75% of their time to fulfil the Commission’s obligations under both the Access to Information Act and the Privacy Act. The Commission also hires one ATIP consultant, as required.

The ATIP coordinator is responsible for implementing and managing programs and services relating to the Commission’s administration of the Access to Information Act and the Privacy Act, as well as for providing advice to its employees as they fulfil their obligations under both Acts.

Responding to Privacy Act requests is a shared responsibility between the delegated request processing team and the Offices of Primary Interest (OPI).

The main activities involved in processing Privacy Act requests are as follows:

• Analyze purpose/history of requests, interpret legislation, and determine information that may be disclosed, exempted or excluded.
• Provide advice and consultation to requesters, third-party stakeholders and the Commission’s management and employees, respond to questions and concerns, ensure that they have a clear understanding of legislation, the Commission policies and procedures for handling requests and other Privacy Act related issues, including document security classification.
• Conduct research and consultations with other departments and third parties to prepare responses to requests.
• Provide recommendations for the preparation of evidence to be disclosed during a Public Interest Hearing in accordance with Privacy Act legislation, Open Court Principles and other related policies and procedures.
• Prepare reports for the Commission’s management on Privacy Act requests and other Privacy Act related matters, including statistical reports, Annual Reports for submission to Parliament and information required by Info Source.

The Commission did not provide services related to privacy to other government institutions and was not a party to any services agreements with other government institutions under section 73.1 of the Privacy Act.

3. Delegation Order

Pursuant to section 73(1) of the Privacy Act, the Chairperson has delegated certain of her powers, duties and functions under the Privacy Act and Regulations to the Senior Director Corporate Services, the Manager of Corporate Reporting, ATIP and Administration and the Administrative Services Officer. The Delegation Order in effect on March 31, 2024, found in Appendix A was signed in October 2023.

4. Performance 2023-24

During this review period, the Commission completed 24 Privacy Act requests, where 0 pages were processed, as 2 requests were transferred to another government department and 22 were requests for which no records existed. Therefore, the Commission had no records for this reporting period that disclosed all or in part information.

The Commission responded to 100% of the Privacy Act requests within the legislated timeline and completed them within 0 to 15 days. All active requests during this review period were closed, and none are outstanding from previous reporting periods.

The graphic below shows, for 2019-20 to 2023-24, the numbers of Privacy Requests the Commission completed each year. The Commission received only 5 Privacy Requests in 2019-20. The Commission received only 10 requests in 2020-21. This number increased significantly during the 2021-22 reporting period but decreased slightly in 2022-23. In 2023-24 the request has significantly increased again. There was a 70 % increase on the previous year. We continue to see an increase in requests since the launch of the centralized ATIP portal.

To note, most of the requests received are intended for the Department of National Defence (DND), to access military police documents, but are mistakenly submitted to us. When a requester types military police in the centralized ATIP portal, the Military Police Complaints Commission comes up and therefore we receive several requests intended for DND. This is one of the reasons why the Commission will be seeking to change the name of our organization through legislative change in the future.

The Commission received and closed one consultation relating to the Privacy Act from another government institution, within a 15-day timeframe.

For additional information, please refer to Appendix B and Appendix C.

5. Training and Awareness

The Commission’s learning directive requires that all new employees complete two mandatory online courses related to Access to Information and Privacy knowledge about properly processing requests and protecting personal information through the Canada School of Public Service portal i.e., Fundamentals of Information Management (COR501) and Access to Information and Privacy Fundamentals (COR502). Managers and the Human Resources ensures that the mandatory training from the Commission’s learning directive is completed within the prescribed timeframe.

The Commission welcomed a new Commission member in June 2023, and he was briefed on the Privacy Act upon his onboarding. Furthermore, employees arriving at the Commission attend an internal awareness session which provides an overview of the proper handling of information and privacy requests, as well as their role and responsibilities relating to the Privacy Act, within their first weeks at the Commission.

6. Policies, Guidelines and Procedures

During this reporting period, the ATIP team implemented a new procedure to provide quarterly status reports on Access to Information and Privacy requests received and closed to the attention of the Commission’s Executive committee.

7. Initiatives and Projects to Improve Privacy

The following internal initiatives to improve Privacy were implemented during the reporting period:

• Creation of a standardized template to inform applicants that their applications will be transferred to DND - May 2023
• Revision and approval of the new ATIP delegation order - July to October 2023
• Review of the extension request letter template – January 2024

8. Summary of Key Issues and Actions Taken on Complaints

Over the period covered by this report, one complaint was filed against the Commission with the Office of the Privacy Commissioner of Canada (OPC). The OPC investigator reached out to the Commission to advise of an official complaint due to the requestor believing information was not disclosed. The Commission provided representation to the OPC by presenting their information and previous proof of communication with the requestor. The Commission resent the communication to the requester for a third time, to ensure they received the final report. The OPC investigator was satisfied with the information and the steps completed by the Commission and closed the file.

No audits were conducted and no appeals concerning privacy requests were filed in Federal Court.

9. Material Privacy Breaches

No material privacy breach occurred at the Commission during the reporting period.

10. Privacy Impact Assessments

No Privacy Impact Assessments were completed during the reporting period.

11. Public Interest Disclosures

During the reporting period, the Commission did not disclose any personal information pursuant to subsection 8(2)(m) of the Privacy Act.

12. Monitoring Compliance

The Manager, Corporate Reporting, ATIP and Administration regularly monitors the timelines associated with the processing of requests through ongoing communications with OPIs and the Senior Director of Corporate Services. From the receipt to the closure of all Privacy requests, the Commission monitors processing times by promptly entering all actions and activities in its internal ATIP status report (which includes both Access to Information and Privacy requests). Legislated timelines are also carefully entered into the report to prevent any delays in the processing of the requests received and to ensure that requests are dealt with in a timely manner. In view of the upward trend in the number of requests, the Commission has noted the need to capture this information for monitoring purposes and is implementing a process to track this information more formally for the next reporting period.

Throughout the year, the Senior Director of Corporate Services / ATIP Coordinator submits the ATIP Status reports to the Executive Committee as an information item on their meeting agendas. The Executive Committee consists of the Chairperson (Deputy Head), the Senior General Counsel and Director General, the Senior Director Corporate Services / ATIP Coordinator and the General Counsel and Senior Director of Operations.

During the review process of requests, the Commission evaluates records that need to be sent for consultation with other federal institutions. Consultation with other federal institutions is done when it is required for the proper exercise of discretion or when there is an intention to disclose records. The ATIP consultant identifies the need for consultation and explains it to the office of primary interest (OPI). Once the OPI agrees, it will then be provided to the Deputy Head for approval.

During this reporting period, the Commission was unable to explore ways to assess the feasibility of making frequently requested types of information publicly available on the Commission’s website due to lack of resources (employees) in the ATIP team.

The Commission ensures appropriate privacy protections in contracts, agreements and arrangements by adding the General conditions to its various contracting documents. The four conditions applied are (1) Compliance with Applicable Laws, (2) Confidentiality, (3) Conflict of interest and (4) Access to information. The Compliance with Applicable Laws condition ensures that the contractor handles personal information in accordance with applicable privacy laws. The Confidentiality condition protects sensitive information by preventing unauthorized disclosure and maintaining privacy. The Conflict of interest condition ensures impartiality and prevents personal gain that could compromise privacy. Finally, the Access to information condition balances transparency with privacy rights, as individuals can access relevant records while protecting sensitive information.

Appendix A – Privacy Act Delegation Order

Appendix B – 2023-24 Statistical Report on the Privacy Act

Name of institution: Military Police Complaints Commission of Canada

Reporting Period: 2023‑04‑01 to 2024‑03‑31

Appendix C – 2023-24 Supplemental Report on the Access to Information Act and the Privacy Act

Name of institution: Military Police Complaints Commission of Canada

Reporting period: 2023‑04‑01 to 2024‑03‑31