Annual Report on the Administration of the Privacy Act
April 1, 2022, to March 31, 2023
Introduction
The Social Sciences and Humanities Research Council (SSHRC) is the federal agency that promotes and supports research and research training in the social sciences and humanities.
The purpose of the Privacy Act is to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and to provide individuals with a right of access to that information.
SSHRC is pleased to provide its annual report on the administration of the Privacy Act, as required by section 72 of the Act. Annual reports are tabled in Parliament in accordance with this same section of the Act.
Administration of the Privacy Act
At SSHRC, the manager, Access to Information and Privacy (ATIP) and Corporate Operations, is responsible for processing requests under the Privacy Act and providing advice and support on matters pertaining to the legislation and compliance with the various Treasury Board of Canada Secretariat (TBS) requirements related to the Act. The manager is supported by two policy analysts, an ATIP officer, and two consultants, on an as-needed basis. The ATIP office is located within SSHRC’s Corporate Strategy and Performance Division, and the manager reports to its executive director.
SSHRC was not party to any service agreements under section 73.1 of the Privacy Act in 2022-23.
All formal requests and complex informal requests are handled by the ATIP office. Other SSHRC divisions may respond to informal requests for information, as appropriate. The ATIP office holds full records of all Privacy Act requests received within the last two years.
As part of its duties under the Privacy Act, SSHRC ensures that written notices are provided to SSHRC applicants, external reviewers, referees, merit review committee members and observers, advising them of their rights and responsibilities under the Act, as well as how the information they access and/or supply is treated and protected in accordance with the legislation. These notices appear in program guides, in SSHRC’s online application and grants management systems, in the SSHRC Manual for Adjudication Committee Members, and in other pertinent material provided throughout the application and review process. Information about the protection and disclosure of personal information both for grants and fellowships and scholarships can also be found on SSHRC’s website.
In 2022-23, SSHRC’s ATIP office continued to update its privacy management infrastructure, including finalizing its privacy management framework and privacy protocol, and making the resource available to staff on the agency intranet.
In addition, merit review committee members, external reviewers and observers are advised of their responsibilities in relation to the Privacy Act and are required to sign a conflict of interest and confidentiality agreement to ensure that the material supplied and used throughout the review process is maintained in strict confidence at all times.
SSHRC’s president and senior management are kept informed of key decisions and developments in the administration and implementation of the Act, as appropriate. The ATIP office provides regular reports to the executive director, Corporate Strategy and Performance, who updates the vice-president, Corporate Affairs, who then briefs the president as needed.
When advice on the administration of the Act is required, it is sought from one or several of the following: the TBS, Department of Justice legal counsel, the Office of the Privacy Commissioner of Canada, SSHRC’s ATIP consultants and other federal government ATIP offices.
Privacy Act delegation order
The current delegation order was approved on April 13, 2022. The order states that the persons holding the following positions are designated to exercise or perform all of the powers, duties and functions of the head of a government institution under the Act insofar as they may be exercised or performed in relation to SSHRC:
- vice-president, Corporate Affairs
- executive director, Corporate Strategy and Performance
- manager, ATIP and Corporate Operations
- policy analyst, ATP and Corporate Operations.
Exceptions are paragraphs 8(2)(e) and 8(2)(m), which are reserved for the president and the vice-president, Corporate Affairs.
Statistical report for fiscal year 2022-23
SSHRC received 9 formal requests during the reporting period, one fewer than it received in the previous year.
SSHRC closed 8 requests during the reporting period. Two requests from 2022-23 were carried over to fiscal year 2023-24, to be closed in that fiscal year. As of March 31, 2023, two requests remain active, both requests were received in fiscal year 2022-23 and are within legislated timelines including extensions allowed under the Act. For both requests, an extension was taken to carry out consultations.
The ATIP office processed four informal requests for access to personal information over the course of the fiscal year.
Of the 8 requests closed during the reporting period, SSHRC processed one request in one to 15 days, four requests within 16 to 30 days, and three requests in 31 to 60 days. This year 100% of requests were closed within their legislated deadlines, including extensions as allowed under the Act. Most requests related to students’ applications for scholarships and fellowships, which require consultations with referees’ institutions and therefore need a legal extension beyond the first 30 days.
Of the 8 requests closed, six had responsive documents, 17% were all disclosed and 83% were disclosed in part. In one case, no records responsive to the request were located.
The statistics show that very few exemptions were applied in the 2023-24 fiscal year. Exempting provisions used multiple times within one request are reported only once per request. SSHRC employed section 26 in five requests.
SSHRC received no consultations from other government institutions or organizations in the fiscal year.
Education and training
Throughout the year, staff and management are reminded and encouraged to consult the ATIP office on any issues that might affect the implementation of the Act when and where appropriate.
The ATIP team provides general training and ad-hoc advice to agency staff on the principles of the privacy legislation, key concepts and definitions, SSHRC’s procedures for processing both formal and informal privacy requests, and employee responsibilities with respect to the Act. There were no formal ATIP training sessions offered in 2022-23, however the ATIP team continued to disseminate its privacy management framework and privacy protocol across SSHRC.
SSHRC created and delivered formal training courses for staff members who require either direct access to or analyze sensitive personal information. The training responds to the SSHRC, NSERC and CIHR joint initiative to collect equity, diversity and inclusion self-identification data for all applicants, co-applicants, collaborators and committee members. In total, the SSHRC ATIP team conducted training for 38 SSHRC staff in 2022-23. The initiative continues in the 2023-24 fiscal year, as required, with plans to automate the training for ease of access by staff.
SSHRC’s new or revised policies, guidelines and procedures related to privacy
No new or revised privacy policies or guidelines were formally implemented during the last fiscal year. Since March 2020 ATIP processing and procedures have been entirely digital. Previously, processes such as document submissions by offices of primary interest, and communications and document releases to requesters, were often paper-based. SSHRC’s operations were not impacted by COVID-19-related measures during this reporting period.
In 2022-23, the ATIP office completed onboarding to the ATIP Online Management Tool and began processing requests through the online system. SSHRC’s ATIP staff have worked with staff in the Research Programs Directorate to develop and enhance text relating to privacy in many memorandums of understanding, especially in relation to joint-funding initiatives. SSHRC ATIP staff have also helped develop and revise privacy notice statements for initiatives involving personal information.
SSHRC jointly implemented its privacy protocol and privacy management framework with NSERC in 2022-23.
Complaints and investigations
One complaint related to the collection and disclosure of personal information was filed with the Office of the Privacy Commissioner of Canada during 2022-23. The complaint was related to SSHRC’s response to a privacy breach.
One investigation remains ongoing at the end of the fiscal year, for the complaint that was received in 2022-23.
SSHRC experienced no court challenges related to privacy during the reporting period.
SSHRC experienced no audits relating to the administration of ATIP legislation during the reporting period.
Monitoring processing times
The executive director, Corporate Strategy and Performance, was regularly kept apprised (normally on a weekly basis) by the Manager, ATIP and Corporate Operations, of all matters and developments pertaining to requests, including processing time, consultations undertaken and any necessary extensions.
SSHRC continues to explore the feasibility of making frequently requested types of information available to requestors through informal means, where appropriate.
Material privacy breaches
No material privacy breaches occurred during the reporting period and no material privacy breaches were reported to the Office of the Privacy Commissioner or to the Treasury Board of Canada Secretariat (Privacy and Responsible Data Division).
Privacy impact assessments
SSHRC completed a privacy impact assessment (PIA) for the Equity, Diversity and Inclusion self-identification questionnaire in fiscal year 2022-23. As of March 31, 2023, the final draft of this PIA was completed. In fiscal year 2023-24, SSHRC will secure approval and signature on the PIA, and submit the PIA to TBS and the Office of the Privacy Commissioner for registration of the modified Personal Information Bank.
Disclosures under subsection 8(2) of the Privacy Act
During the reporting period SSHRC made no disclosures pursuant to paragraph 8(2)(m) of the Act, which pertains to disclosures of personal information in instances where there is a public interest in the disclosure or where disclosure would benefit the individual involved.
- Date modified: