National Research Conseil national Council Canada de recherches Canada

Annual Report to Parliament2012-2013

Privacy Act

TABLE OF CONTENTS

I. INTRODUCTION__________________________________________________3II. DELEGATION OF AUTHORITY______________________________________3III. ORGANIZATIONAL STRUCTURE___________________________________4IV. INTERPRETATION OF STATISTICAL REPORT________________________5V. PRIVACY-RELATED TRAINING AND EDUCATION______________________6VI. NEW PROCEDURES, GUIDELINES AND DIRECTIVES__________________6VII. PRIVACY COMPLAINTS___________________________________________6VIII. PRIVACY IMPACT ASSESSMENT ACTIVITIES_________________________6IX. SECTION 8(2)(m) DISCLOSURES___________________________________6

ANNEX A: DELEGATION ORDER_________________________________________7ANNEX B: STATISTICAL REPORT_________________________________________8

2

I. INTRODUCTION

The purpose of the Privacy Act is to extend the present laws of Canada that protect the privacy of individuals and that provide individuals with a right of access to personal information about themselves. The federal Privacy Act regulates the collection, use and disclosure of personal information held by federal institutions including the National Research Council Canada (NRC).

In accordance with Section 72 of the Privacy Act, this twenty-ninth Annual Report on the administration of the Privacy Act at NRC describes how NRC discharged its responsibilities in relation to the Act in the fiscal year 2012-2013. The Annual Report is tabled in Parliament in accordance with section 72 of the Privacy Act.

The National Research Council Canada is an agency of the Government of Canada established in 1916. Its mandate is to help build an innovative, knowledge-based economy for Canada through research and development, technology commercialization and industry support.

As stated in the NRC Act, the agency is responsible for: undertaking, assisting or promoting scientific and industrial research in different fields of importance to Canada; establishing, operating and maintaining a national science library; publishing and selling or otherwise distributing such scientific and technical information as the Council deems necessary; investigating standards and methods of measurement; working on the standardization and certification of scientific and technical apparatus and instruments and materials used or usable by Canadian industry; operating and administering any astronomical observatories established or maintained by the Government of Canada; administering NRC's research and development activities, including contributions used to support a number of international activities; and providing vital scientific and technological services to the research and industrial communities.

II. DELEGATION OF AUTHORITY

The NRC President has delegated the responsibilities associated with the administration of the Privacy Act to the Executive Vice President and Secretary General and Director, Corporate Governance. Operational responsibility for the application of the Act has been delegated to the Access to Information and Privacy Coordinator.

A detailed signed Delegation Order can be found at Annex A.

3

III. ORGANIZATIONAL STRUCTURE

The Executive Vice President and Secretary General has overall responsibility for ensuring that NRC’s policies, procedures and practices are in line with the application and administration of the Privacy Act. As shown in the Delegation Order, the Executive Vice President and Secretary General has delegated some of her authority to the Director, Corporate Governance and to the Access to Information and Privacy (ATIP) Coordinator. The NRC Access to Information and Privacy (ATIP) office is part of the NRC Secretary General’s Office (SGO).

The NRC ATIP office is comprised of one part-time Coordinator and two Officers. The NRC ATIP office works closely with the NRC Records Services, NRC Industrial Research Assistance Program ATIP liaison officer, NRC Human Resources ATIP liaison officer, NRC Communication Branch and senior management across the organization. Procedures are in place to process all privacy requests. These requests are processed by the Access to Information and Privacy Coordinator who has the authority to access all records held by NRC.

The ATIP office is responsible for the coordination and implementation of policies, guidelines and procedures to ensure the organization’s compliance with the Privacy Act. To that end, the office provides the following services to the organization:

- Promote awareness of the Privacy Act within NRC- Processes privacy requests and privacy complaints- Provides advice and guidance to employees and senior officials on Privacy

related matters- Prepares an Annual Report to Parliament- Responds to the SGO on the privacy related matters mentioned in the

Management Accountability Framework- Coordinates and implements updates to Info Source - Administers Privacy Impact Assessments- Review Harassment Reports- Manages the ATIP electronic management system- Develops internal procedures, policies and guidelines- Participates in forums for the ATIP Community, such as the Treasury Board

Secretariat ATIP Community Meetings, Training and Annual Meetings.

The ATIP office is responsible for the implementation of the new TBS directives, and has worked in consultation with various sectors of the organization to complete a privacy management framework in the form of a policy governing the management of personal information.

4

IV. INTERPRETATION OF STATISTICAL REPORT

Annex B provides a summarized statistical report on the privacy requests received and processed by the National Research of Council from 1 April 2012 to 31 March 2013. This section provides an interpretation of the statistical report.

During the fiscal year, NRC received fifteen (15) new privacy requests. One (1) request was outstanding from the previous fiscal year for a total of sixteen (16) privacy requests to process in this fiscal year. During this reporting period, NRC completed the processing of a total of fourteen (14) privacy requests. Two (2) requests were carried forward into 2013-2014.

Section 15 of the Privacy Act allows institutions to extend the legal deadline for processing a request. NRC invoked an extension in four (4) cases of the fourteen (14) Privacy requests. Meeting the original time limit of thirty days would have unreasonably interfered with the operations of the organization. In summary, out of the fourteen (14) requests, eight (8) were completed within 30 days or less and four (4) took between 3 and 60 days to complete. Two (2) requests were abandoned.

The exemption invoked was pursuant to section 26 of the Privacy Act. Section 26 (information about another individual) was applied in eight cases (8).

The figures, as reflected in the chart below, indicate the number of requests received and processed over the past three years. The figures do not reflect requests processed informally or other queries that have been received in the ATIP office. NRC does expect that privacy requests and queries concerning privacy-related matters will continue to represent a significant portion of the workload due to the ongoing organizational changes.

2010-2011 2011-2012 2012-201302468

10121416

receivedcompletedcarried forward

The annual statistical report for the fiscal year 2012-2013 is included at the end of this chapter, as Annex B.

5

V. PRIVACY-RELATED TRAINING AND EDUCATION

The ATIP office is committed to providing ongoing development and training to NRC’s employees.

During the fiscal year, a formal ATIP and Managing NRC Information Course (3 hours) was offered on 21 March 2013 with 14 participants and three training sessions via teleconference were offered on 15, 16 and 17 May 2012 with 13-16 participants per session.

ATIP employees continually sensitize and guide employees, third parties and requesters regarding the requirements of the Privacy Act by means of ongoing dialogue. During the reporting period, ATIP officers responded to inquiries from colleagues, where advice and guidance were provided on various subjects pertaining to Privacy legislation.

Within the context of its roles and responsibilities, NRC’s ATIP office reviewed a total of eighty-six (86) parliamentary questions received for the period of April 2012 to March 2013. In addition, two (2) harassment reports were reviewed from a privacy perspective.

All awareness sessions included information on the access to information legislation which has been accounted for in the Access to Information Act annual report.

VI. NEW PROCEDURES, GUIDELINES AND DIRECTIVES

NRC did not implement new and/or revised policies, guidelines or procedures during the reporting period.

VII. PRIVACY COMPLAINTS

During this fiscal year, NRC did not receive any privacy complaint.

VIII. PRIVACY IMPACT ASSESSMENT ACTIVITIES

NRC did not complete any Privacy Impact Assessments during the reporting period.

IX. SECTION 8(2)(m) DISCLOSURES

There was no disclosure made pursuant to section 8(2)(m) of the Privacy Act during the reporting period.

6

ANNEX A: DELEGATION ORDER

7

ANNEX B: STATISTICAL REPORT

Statistical Report on the Privacy Act

Name of institution: National Research Council

Reporting period: 2012-04-01 to 2013-03-31

Part 1 Requests under the Privacy Act

Number of Requests

Received during reporting period 15

Outstanding from previous reporting period

1

TOTAL 16

Completed during reporting period 14

Carried over to next reporting period 2

Part 2 Requests closed during the reporting period2.1 Disposition and completion time

Completion TimeDisposition of

requests1 to 15 days

16 to 30 days

31 to 60 days

61 to 120 days

121 to 180 days

181 to 365 days

More than 365

daysTOTAL

All disclosed 1 1 1 0 0 0 0 3

Disclosed in part 0 5 3 0 0 0 0 8

All exempted 0 0 0 0 0 0 0 0

All excluded 0 0 0 0 0 0 0 0

No records exit 1 0 0 0 0 0 0 1

Request abandoned 0 0 2 0 0 0 0 2

TOTAL 2 6 6 0 0 0 0 14

2.2 Exemptions

8

SectionNumber of requests Sections

Number of requests Sections

Number of requests

18(2) 0 22(1)(a)(i) 0 23(a) 0

19(1)(a) 0 22(1)(a)(ii) 0 23(b) 0

19(1)(b) 0 22(1)(a)(iii) 0 24(a) 0

19(1)(c) 0 22(1)(b) 0 24(b) 0

19(1)(d) 0 22(1)(c) 0 25 0

19(1)(e) 0 22(2) 0 26 8

19(1)(f) 0 22.1 0 27 0

20 0 22.2 0 28 0

21 0 22.3 0

2.3 Exclusions

SectionNumber of requests Section

Number of requests Section

Number of requests

69(1)(a) 0 70 (1)(a) 0 70 (1)(d) 0

69(1)(b) 0 70 (1)(b) 0 70 (1)(e) 0

69.1 0 70 (1)(c) 0 70 (1)(f) 0

70.1 0

2.4 Format of information releasedDisposition Paper Electronic Other formats

All disclosed 3 0 0Disclosed in part 8 0 0TOTAL 11 0 0

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

9

Disposition of requests

Number of pages processed

Number of pages disclosed

Number of requests

All disclosed 159 159 3

Disclosed in part 2423 2423 8

All exempted 0 0 0

All excluded 0 0 0

Request abandoned 0 0 2

2.5.2 Relevant pages processed and disclosed by size of requests

Less than 100 pages reviewed

101-500 pages processed

501-1000 pages processed

1001-5,000 pages

processed

More than 5000 pages

processed

DispositionNumber

of Requests

Pages disclosed

Number of

RequestsPages

disclosed

Number of

RequestsPages

disclosed

Number of

RequestsPages

disclosed

Number of

RequestsPages

disclosed

All disclosed 2 12 1 147 0 0 0 0 0 0

Disclosed in part 5 177 2 366 0 0 1 1880 0 0

All exempted 0 0 0 0 0 0 0 0 0 0

All excluded 0 0 0 0 0 0 0 0 0 0

Abandoned 2 0 0 0 0 0 0 0 0 0

Total 9 189 3 513 0 0 1 1880 0 0

2.5.3 Other complexities

DispositionConsultation

requiredLegal Advice

SoughtInterwoven Information Other Total

All disclosed 0 0 0 0 0

Disclosed in part 0 0 0 1 1

All exempted 0 0 0 0 0

All excluded 0 0 0 0 0

Abandoned 0 0 0 0 0

Total 0 0 0 1 1

2.6 Deemed refusals

2.6.1 Reasons for not meeting statutory deadline

Principal Reason

10

Number of requests closed

past the statutory deadline

Workload External consultation

Internal consultation

Other

1 0 0 0 1

2.6.2 Number of days past deadlineNumber of days

past deadlineNumber of requests past

deadline where no extension was taken

Number of requests past deadline where an

extension was taken Total

1 day to 15 days 1 0 1

16 to 30 days 1 0 1

31 to 60 days 0 0 0

61 to 120 days 0 0 0

121 to 180 days 0 0 0

181 to 365 days 0 0 0

More than 365 days 0 0 0

Total 2 0 2

2.7 Requests for translation

Translation Requests Accepted Refused Total

English to French 0 0 0

French to English 0 0 0

Total 0 0 0

Part 3 Disclosures under subsection 8(2)

Paragraph8(2)(e)

Paragraph8(2)(m) Total

0 0 0

Part 4 Request for correction of personal information and notations

Number

Requests for correction received 0

Requests for correction accepted 0

11

Requests for correction refused 0

Notations attached 0

Part 5 Extensions5.1 Reasons for extensions and disposition of requests

Disposition of requestswhere an extension was

taken

15(a)(i)Interference with

operations

15(a)(ii)Consultations

15(b)Translation or

conversion

Section 70 Other

All disclosed 1 0 0 0

Disclosed in part 3 0 0 0

All exempted 0 0 0 0

All excluded 0 0 0 0

No records exist 0 0 0 0

Request abandoned 0 0 0 0

TOTAL 4 0 0 0

5.2 Length of extensions

15(a)(i)Interference with

operations15(a)(ii)

Consultation

15(b)Translationpurposes

Length of extensions

Section 70 Other

1 to 15 days 0 0 0 0

16 to 30 days 4 0 0 0

TOTAL 4 0 0 0

Part 6 Consultations received from other institutions and organizations6.1 Consultations received from other government institutions and

organizations

Consultations

Othergovernment institutions

Number ofpages to review Other

organizations

Number of pages to review

12

Received during reporting period

0 0 0 0

Outstanding from the previous reporting period

0 0 0 0

Total 0 0 0 0

Completed during the reporting period

0 0 0 0

Pending at the end of the reporting period

0 0 0 0

6.2 Recommendations and completion time for consultations received from other government institutions

Number of days required to complete consultation requests

Recommendation1 to 15 days

16 to 30 days

31 to 60 days

61 to 120

days

121 to180

days

181 to365

days

More than 365

daysTOTAL

Disclose entirely 0 0 0 0 0 0 0 0

Disclose in part 0 0 0 0 0 0 0 0

Exempt entirely 0 0 0 0 0 0 0 0

Exclude entirely 0 0 0 0 0 0 0 0

Consult other institution 0 0 0 0 0 0 0 0

Other 0 0 0 0 0 0 0 0

TOTAL 0 0 0 0 0 0 0 0

6.3 Recommendations and completion time for consultations received from other organizations

Number of days required to complete consultation requests

Recommendation 1 to 15 days

16 to 30 days

31 to 60 days

61 to 120

days

121 to180

days

181 to365

days

More than 365

days

TOTAL

13

Disclose entirely 0 0 0 0 0 0 0 0

Disclose in part 0 0 0 0 0 0 0 0

Exempt entirely 0 0 0 0 0 0 0 0

Exclude entirely 0 0 0 0 0 0 0 0

Consult other institution 0 0 0 0 0 0 0 0

Other 0 0 0 0 0 0 0 0

TOTAL 0 0 0 0 0 0 0 0

Part 7 Completion time of consultations on Cabinet confidences

Number of Days

Number of responsesreceived

Number of responses received past deadline

1 to 15 0 016 to 30 0 031 to 60 0 061 to 120 0 0121 to 180 0 0181 to 365 0 0More than 365 0 0

Total 0 0

Part 8 Resources related to the Privacy Act

8.1 CostsExpenditures Amount

Salaries $52,650.00

Overtime 0.00

14

Goods and Services $33,413.00

• Contracts for privacy impact assessments 0.00

• Professional Services Contracts $20,528.00

• Other $12,885.00

Total $86,063.00

8.2 Human Resources

Resources

Dedicated full-time

Dedicatedpart-time

Total

Full-time employees 1 0 1Part-time and casual employees

0 0 0

Regional staff 0 0 0Consultants and agency personnel 0 0 0

Students 0 0 0

Total 1 0 1

15