Annual Report on the Administration of the Privacy Act
April 1, 2018, to March 31, 2019

Introduction

The Social Sciences and Humanities Research Council (SSHRC) is a federal agency that promotes and supports research and research training in the social sciences and humanities.

SSHRC is pleased to provide its annual report on the administration of the Privacy Act, as required by section 72 of the Act. Annual reports are tabled in Parliament in accordance with this same section of the Act.

The purpose of the Privacy Act is to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and to provide individuals with a right of access to that information.

Administration of the Privacy Act

At SSHRC, processing requests under the Privacy Act and providing advice and support on matters pertaining to the legislation is the responsibility of the Manager, Access to Information and Privacy (ATIP) and Corporate Operations. The ATIP office is located within SSHRC’s Corporate Strategy and Performance Division and the manager, ATIP and Corporate Operations, who is supported by a policy analyst and a half-time ATIP officer, reports to its executive director. During the period covered by this report, the manager, ATIP and Corporate Operations, and the policy analyst each spent approximately one and a half days per week each week processing requests and administering the various Treasury Board Secretariat (TBS) requirements related to the Act. 

All formal requests and complex informal requests are handled by the ATIP office.

As part of its duties under the Privacy Act, SSHRC ensures that written notices are provided to SSHRC applicants, external reviewers, referees, merit review committee members and observers advising them of their rights and responsibilities under the Act, as well as how the information they access and/or supply is treated and protected in accordance with the legislation. These notices appear in program guides, in SSHRC’s online application and grants management systems, in the SSHRC Manual for Adjudication Committee Members, and in other pertinent material provided throughout the application and review process. Information pertaining to the protection and disclosure of personal information can also be found on SSHRC’s website, for both grants and fellowships and scholarships.

In 2018-19, SSHRC's ATIP office, in concert with the Natural Sciences and Engineering Research Council’s (NSERC) ATIP office, created and updated the joint SSHRC-NSERC program platform privacy notices to reflect the new collection of equity, diversity and inclusion data for all tri-agency applicants, co-applicants, collaborators and committee members. SSHRC’s ATIP office is undertaking updates to its privacy management infrastructure and has developed a draft privacy management framework and privacy protocol.

In addition, merit review committee members, external reviewers and observers are advised of their responsibilities in relation to the Privacy Act and are required to sign a conflict of interest and confidentiality agreement to ensure that the material supplied and used throughout the review process is maintained in strict confidence at all times.

SSHRC’s President and senior management are kept informed of key decisions and developments in the administration and implementation of the Act, as appropriate. The ATIP office provides ongoing reports to the executive director, Corporate Strategy and Performance, who provides updates to the executive vice-president, Corporate Affairs, who then briefs the president as needed.

When advice on the administration of the Act is required, it is sought from one or several of the following: the TBS, Department of Justice legal counsel, the Office of the Privacy Commissioner of Canada (OPC), SSHRC’s ATIP consultant and other federal government ATIP offices.

Privacy Act Delegation Order

A copy of SSHRC’s delegation order for the Privacy Act is attached. The order—with the exception of paragraphs 8(2)(e) and 8(2)(m), which are reserved for the president, the executive vice-president, and the executive director, Corporate Strategy and Performance—states that the persons holding the positions of executive vice-president; executive director, Corporate Strategy and Performance; and manager, ATIP and Corporate Operations, are designated to exercise or perform all of the powers, duties and functions of the head of a government institution under the Act, insofar as they may be exercised or performed in relation to SSHRC.

Statistical Report for Fiscal Year 2018-19

The statistical report for the period of April 1, 2018 to March 31, 2019 is appended.

Fifteen formal requests were received during the reporting period. This is a substantial increase over previous years and a reverse of the trend of decline in this area.

Thirteen requests were closed during the reporting period. Zero requests from the previous year were carried over to 2018-19 and were closed in that fiscal year.

One informal request for access to personal information was received and processed by the ATIP office over the course of the fiscal year. SSHRC normally receives a higher number of informal requests compared to the number of formal requests.

Of the 13 requests closed during the reporting period, one request was processed in fewer than 15 days and eight requests were processed in 16 to 30 days. Three requests were completed in 31 to 60 days, and one request was processed in 61 to 120 days. This year, 69% of requests were closed within the first 30 days.

All 11 requests that had responsive documents were disclosed in electronic format.

The statistics demonstrate that very few exemptions were applied in the 2018-19 fiscal year. Exempting provisions used multiple times within one request are reported only once per request. SSHRC only employed sections 26 in six requests and section 27 in two requests.

In one case, no records responsive to the request were located. One request was abandoned during the fiscal year.

One consultation from another government institution or organization was received by SSHRC in the fiscal year.

Education and Training

Throughout the year, staff and management are reminded and encouraged to consult the ATIP office on any issues that might affect the implementation of the Act when and where appropriate.

During 2018-19, the manager, ATIP and Corporate Operations, provided the standing annual training session open to all SSHRC staff, which was well attended, by approximately 25 staff members.This session covers the principles of the privacy legislation, key concepts and definitions, SSHRC’s procedures for processing both formal and informal privacy requests, and employee responsibilities with respect to the Act. The in-house session is part of the SSHRC in-house training session to the Management Accreditation Roadmap.

SSHRC created and delivered formal training courses for staff members who require either direct access to or analyze sensitive personal information. The training responds to the SSHRC, NSERC and Canadian Institutes of Health Research (CIHR) joint initiative to collect equity, diversity and inclusion data for all applicants, co-applicants, collaborators and committee members In total, the SSHRC ATIP team conducted eight training sessions, where 92 NSERC, 49 SSHRC and 1 CIHR staff were trained. The initiative continues in the 2019-20 fiscal year, as required.

SSHRC’s New or Revised Policies, Guidelines and Procedures Related to Privacy

SSHRC’s ATIP staff have worked with staff in the Research Programs Directorate to develop and enhance text relating to privacy in numerous memorandums of understanding, especially in relation to joint-funding initiatives. 

SSHRC has created a draft privacy protocol and privacy management framework, which it plans to formally adopt in the 2019-20 fiscal year.

Complaints and Investigations

Three complaints with respect to the Privacy Act were filed with the Office of the Privacy Commissioner of Canada (OPC) during the fiscal year 2018-19. One related to extensions, one to time limits, and one was of a miscellaneous nature.

In 2018-19, SSHRC provided the OPC with representations for three complaints and received findings for three complaints. Of these three, all three were not well founded. Two investigations were ongoing as of the end of the fiscal year.

SSHRC experienced no court challenges related to privacy during the reporting period.

SSHRC experienced no audits relating the administration of ATIP legislation during the reporting period.

Monitoring Processing Times

The executive director, Corporate Strategy and Performance, was regularly kept apprised (normally on a weekly basis) by the Manager, ATIP and Corporate Operations, of all matters and developments pertaining to requests, including processing time, consultations undertaken and any necessary extensions.

Material Privacy Breaches

No material privacy breaches were closed during the reporting period.

Privacy Impact Assessments

SSHRC completed the privacy impact assessment (PIA) for the Canada 150 Research Chairs program, and SSHRC’s ATIP staff have begun to implement improvements, which include the consolidation and maturation of SSHRC’s privacy polcies and proactices in 2018-19. A full description of all of the follow-ups to this PIA will be provided in next year’s report.

Disclosures Under Subsection 8(2) of the Privacy Act

During the reporting period, SSHRC made no disclosures pursuant to paragraph 8(2)(m) of the Act, which pertains to disclosures of personal information in instances where there is a public interest in the disclosure or where disclosure would benefit the individual involved.

New Exemptions Tables

Date modified:

2020-01-28