Introduction

The Social Sciences and Humanities Research Council (SSHRC) is a federal agency that promotes and supports research and training in the social sciences and humanities.

SSHRC is pleased to provide its annual report on the administration of the Privacy Act, as required by section 72 of the Act.

The purpose of the Privacy Act is to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and to provide individuals with a right of access to that information.

Administration of the Privacy Act

At SSHRC, responsibility for processing requests under the Privacy Act and providing advice and support on matters pertaining to the legislation falls to the Access to Information and Privacy (ATIP) Coordinator. Both formal and informal requests are routed through the ATIP Coordinator’s office.

During the period covered by this report, the ATIP Coordinator spent, on average, one and a half days per week administering the requests (formal and informal) and the various Treasury Board requirements related to the Privacy Act. 

As part of its duties under the Privacy Act, SSHRC ensures that written notices are provided to SSHRC applicants, reviewers, referees and merit review committee members advising them of their rights and responsibilities under the Act as well as the manner in which the information they supply is treated in accordance with the legislation. These notices appear in program guides, in the portal to SSHRC’s online application system, and in other pertinent material sent to applicants and reviewers of applications.

In addition, merit review committee members are advised of their responsibilities in relation to the Privacy Act and are required to sign a declaration ensuring the confidentiality of the material used in adjudication deliberations.

When advice on the administration of the Act is required, it is sought from the Treasury Board of Canada Secretariat, Department of Justice legal counsel, the Office of the Information Commissioner, and/or other federal government ATIP offices.

The ATIP Coordinator’s office holds records of all privacy requests received within the last two years.

Privacy Act Designation Order

A copy of SSHRC’s designation order for the Access to Information Act and the Privacy Act is attached. The order—with the exception of paragraphs 8(2)(e) and 8(2)(m), which are reserved for the president, executive vice-president, and executive director, Corporate Strategy and Performance—states that the persons holding the positions of executive vice-president; executive director, Corporate Strategy and Performance; and ATIP Coordinator, are designated to exercise or perform all of the powers, duties and functions of the head of a government institution under the Act insofar as they may be exercised or performed in relation to SSHRC.

Statistical Report for the Fiscal Year 2013-14

The statistical report for the period of April 1, 2013 to March 31, 2014 is appended.

Zero (0) formal requests were received during the reporting period, which is somewhat of an anomaly for SSHRC. A higher than average number of formal requests (i.e., eight [8]) was received in 2012-2013.  

Description of figure

Formal Requests Received

This graph shows the number of formal requests under the Privacy Act received by SSHRC in the five fiscal years spanning 2009 and 2014.

The X-axis presents the fiscal years, with each year represented by a bar.

The Y-axis presents the number of requests received in each fiscal year.

The data presented in the graph is as follows:

• 2009-2010: 7 formal requests received
• 2010-2011: 2 formal requests received
• 2011-2012: 3 formal requests received
• 2012-2013: 8 formal requests received
• 2013-2014: 0 formal request received

Nine (9) informal requests for access to personal information were received and processed by the ATIP Coordinator over the course of the fiscal year. It is not uncommon for SSHRC to have a higher number of informal requests than formal requests.

Privacy Impact Assessments

In the 2013-2014 fiscal year, discussions concerning the privacy impact assessment (PIA) of SSHRC’s new Research Portal platform for the management of grants and awards were renewed between SSHRC and the Natural Sciences and Engineering Research Council (NSERC). The two agencies will jointly coordinate and lead the PIA work in the coming year. It is expected that the PIA will be completed and approved in 2014-2015. In addition, a PIA for SSHRC’s new Achievement Reporting system is currently underway, and is also expected to be completed in 2014-2015.

Education and Training

During the fiscal year 2013-2014, the ATIP Coordinator delivered three (3) training sessions to a total of ten (10) SSHRC staff members. The sessions covered the principles of privacy legislation, SSHRC’s procedures for processing related requests, and procedures for the use, security, preservation and disposition of personal information under SSHRC's custody and control.

Disclosures Under Paragraph 8(2) of the Privacy Act

During this reporting period SSHRC made no disclosures pursuant to section 8(2)(m) of the Act, which pertains to disclosures of personal information in instances where there is a public interest in the disclosure or where disclosure would benefit the individual involved.

Significant Changes to SSHRC’s Organization, Programs, Operations, or Policies

SSHRC has worked to implement the use of Access Pro software (a case management and redaction tool) over the course of 2013-2014, and will begin using the software to process all requests under the Privacy Act as of April 1, 2014. SSHRC also hired a new ATIP Coordinator in December of 2013.

In collaboration with NSERC, SSHRC finalized its Privacy/Security Breach Protocol, which came into effect October 8, 2013. The purpose of this protocol document is to contain and respond to any incidents resulting in the unauthorized disclosure of personal information by SSHRC, and to ensure that the reporting process is complete and consistent; and that, if required, corrective and preventative measures are implemented. The protocol is accompanied by a breach reporting form and both documents are available on SSHRC's Intranet (internal website). 

The decentralized publishing requirements for Info Source came into effect for SSHRC in December 2013, and SSHRC has since published its own Info Source chapter on its website. SSHRC continues to update this chapter, as needed, in order to harmonize it with SSHRC’s program alignment architecture and to ensure that the information is presented clearly.

Complaints, Investigations and Appeals to the Office of the Information Commissioner

No complaints with respect to requests under the Privacy Act were filed with the Office of the Privacy Commissioner of Canada during the fiscal year 2013-2014. 

Monitoring processing times

The Executive Director, Corporate Strategy and Performance was regularly kept apprised (normally on a weekly basis) by the ATIP Coordinator of all matters pertaining to the Privacy Act. During the reporting period, SSHRC began its transition to the use of Access
Pro software, which is the tool that the Agency will use as of April 1, 2014 to monitor the time to process privacy requests and requests for the correction of personal information.

Appeals to Courts

One appeal is before the Federal Court pertaining to a request submitted to SSHRC in a previous fiscal year. The outcome of the case is not yet known.

June 2014