Annual Report on the Administration of the Privacy Act
April 1, 2021, to March 31, 2022

Introduction

The Social Sciences and Humanities Research Council (SSHRC) is the federal agency that promotes and supports research and research training in the social sciences and humanities.

The purpose of the Privacy Act is to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and to provide individuals with a right of access to that information.

SSHRC is pleased to provide its annual report on the administration of the Privacy Act, as required by section 72 of the Act. Annual reports are tabled in Parliament in accordance with this same section of the Act.

Administration of the Privacy Act

At SSHRC, the manager, Access to Information and Privacy (ATIP) and Corporate Operations, is responsible for processing requests under the Privacy Act and providing advice and support on matters pertaining to the legislation and compliance with the various Treasury Board of Canada Secretariat (TBS) requirements related to the Act. The manager is supported by two policy analysts and an ATIP officer. The ATIP office is located within SSHRC’s Corporate Strategy and Performance Division, and the manager reports to its executive director.

All formal requests and complex informal requests are handled by the ATIP office. Other SSHRC divisions may respond to informal requests for information, as appropriate. The ATIP office holds full records of all Privacy Act requests received within the last two years.

As part of its duties under the Privacy Act, SSHRC ensures that written notices are provided to SSHRC applicants, external reviewers, referees, merit review committee members and observers, advising them of their rights and responsibilities under the Act, as well as how the information they access and/or supply is treated and protected in accordance with the legislation. These notices appear in program guides, in SSHRC’s online application and grants management systems, in the SSHRC Manual for Adjudication Committee Members, and in other pertinent material provided throughout the application and review process. Information about the protection and disclosure of personal information both for grants and fellowships and scholarships can also be found on SSHRC’s website.

In 2021-22, SSHRC’s ATIP office continued to update its privacy management infrastructure, including finalizing consultations on its draft privacy management framework and privacy protocol. The privacy management framework and privacy protocol were presented to internal management committees for endorsement in 2021-22.

In addition, merit review committee members, external reviewers and observers are advised of their responsibilities in relation to the Privacy Act and are required to sign a conflict of interest and confidentiality agreement to ensure that the material supplied and used throughout the review process is maintained in strict confidence at all times.

SSHRC’s president and senior management are kept informed of key decisions and developments in the administration and implementation of the Act, as appropriate. The ATIP office provides regular reports to the executive director, Corporate Strategy and Performance, who updates the executive vice-president (as of November 2021, the vice-president), Corporate Affairs, who then briefs the president as needed.

When advice on the administration of the Act is required, it is sought from one or several of the following: the TBS, Department of Justice legal counsel, the Office of the Privacy Commissioner of Canada, SSHRC’s ATIP consultants and other federal government ATIP offices.

Privacy Act Delegation Order

The current delegation order was approved on March 1, 2015. The order states that the persons holding the following positions are designated to exercise or perform all of the powers, duties and functions of the head of a government institution under the Act insofar as they may be exercised or performed in relation to SSHRC:

• executive vice-president (as of November 2021, the vice-president), Corporate Affairs
• executive director, Corporate Strategy and Performance
• manager, ATIP and Corporate Operations.

Exceptions are paragraphs 8(2)(e) and 8(2)(m), which are reserved for the president and the executive vice-president (as of November 2021, the vice-president), Corporate Affairs).

Statistical Report for Fiscal Year 2021-22

SSHRC received 10 formal requests during the reporting period, the same number as it received in the previous year.

SSHRC closed 11 requests during the reporting period. One request from 2021-22 was carried over to fiscal year 2022-23, to be closed in that fiscal year.

The ATIP office processed three informal requests for access to personal information over the course of the fiscal year. SSHRC now receives more formal requests than informal requests, a reversal of the previous trend.

Of the 11 requests closed during the reporting period, SSHRC processed two requests in one to 15 days, three requests within 16 to 30 days, and six requests in 31 to 60 days. This year, five requests were closed within the first 30 days, and 100% were closed within their legislated deadlines, including extensions as allowed under the Act. Most requests related to students’ applications for scholarships and fellowships, which require consultations with referees’ institutions and therefore need a legal extension beyond the first 30 days.

Of the 11 requests closed, eight had responsive documents, 100% of which were disclosed in part and disclosed in electronic format.

The statistics show that very few exemptions were applied in the 2021-22 fiscal year. Exempting provisions used multiple times within one request are reported only once per request. SSHRC employed section 26 in eight requests.

In three cases, no records responsive to the request were located.

SSHRC received no consultations from other government institutions or organizations in the fiscal year.

Education and Training

Throughout the year, staff and management are reminded and encouraged to consult the ATIP office on any issues that might affect the implementation of the Act when and where appropriate.

The ATIP team provides general training to agency staff on the principles of the privacy legislation, key concepts and definitions, SSHRC’s procedures for processing both formal and informal privacy requests, and employee responsibilities with respect to the Act. Due to the COVID-19 pandemic, there were no ATIP training sessions offered in 2021-22; however, the ATIP team continued to disseminate its privacy management framework and privacy protocol across SSHRC.

SSHRC created and delivered formal training courses for staff members who require either direct access to or analyze sensitive personal information. The training responds to the SSHRC, NSERC and CIHR joint initiative to collect equity, diversity and inclusion data for all applicants, co-applicants, collaborators and committee members. In total, the SSHRC ATIP team conducted training for 41 SSHRC staff in 2021-22. The initiative continues in the 2022-23 fiscal year, as required.

SSHRC’s New or Revised Policies, Guidelines and Procedures Related to Privacy

No new or revised privacy policies or guidelines were formally implemented during the last fiscal year. Due to the COVID-19 pandemic, ATIP processing and procedures became entirely digital. Previously, processes such as document submissions by offices of primary interest, and communications and document releases to requesters, were often paper-based.

SSHRC’s ATIP staff have worked with staff in the Research Programs Directorate to develop and enhance text relating to privacy in many memorandums of understanding, especially in relation to joint-funding initiatives.

SSHRC continued consultations on its draft privacy protocol and privacy management framework, which it plans to jointly implement with NSERC. In 2021-22, SSHRC received endorsement of its draft privacy protocol and privacy management framework from internal management committees.

Complaints and Investigations

No complaints related to the collection and disclosure of personal information were filed with the Office of the Privacy Commissioner of Canada during 2021-22.

No investigations were ongoing at the end of the fiscal year.

SSHRC experienced no court challenges related to privacy during the reporting period.

SSHRC experienced no audits relating to the administration of ATIP legislation during the reporting period.

Monitoring Processing Times

The executive director, Corporate Strategy and Performance, was regularly kept apprised (normally on a weekly basis) by the Manager, ATIP and Corporate Operations, of all matters and developments pertaining to requests, including processing time, consultations undertaken and any necessary extensions.

Material Privacy Breaches

No material privacy breaches occurred during the reporting period.

Privacy Impact Assessments

SSHRC continued two privacy impact assessments in the 2021-22 fiscal year, one for the Convergence Portal application system and one for the New Frontiers in Research Fund. In fiscal year 2021-22, SSHRC also began work on a new privacy impact assessment for the Equity, Diversity and Inclusion survey. As of March 31, 2022, the key risks for this new privacy impact assessment had been developed.

Disclosures Under Subsection 8(2) of the Privacy Act

During the reporting period, SSHRC made no disclosures pursuant to paragraph 8(2)(m) of the Act, which pertains to disclosures of personal information in instances where there is a public interest in the disclosure or where disclosure would benefit the individual involved.

Date modified:

2022-10-31