Introduction
The Social Sciences and Humanities Research Council (SSHRC) is a federal agency that promotes and supports research and research training in the social sciences and humanities.
SSHRC is pleased to provide its annual report on the administration of the Privacy Act, as required by section 72 of the act. Annual reports are tabled in Parliament in accordance with this same section of the act.
The purpose of the Privacy Act is to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and to provide individuals with a right of access to that information.
Administration of the Privacy Act
At SSHRC, processing requests under the Privacy Act and providing advice and support on matters pertaining to the legislation is the responsibility of the manager, Access to Information and Privacy (ATIP) and Corporate Operations. The ATIP office is located within SSHRC’s Corporate Strategy and Performance Division and the manager, ATIP and Corporate Operations, who is supported by a corporate analyst, reports to its executive director. During the period covered by this report, the Manager, ATIP and Corporate Operations, spent three days per week and the corporate analyst spent approximately 1 day a week processing requests and administering the various Treasury Board Secretariat requirements related to the act.
As part of its duties under the Privacy Act, SSHRC ensures that written notices are provided to SSHRC applicants, external reviewers, referees, merit review committee members and observers advising them of their rights and responsibilities under the act as well as how the information they access and/or supply is treated and protected in accordance with the legislation. These notices appear in program guides, in SSHRC’s online application and grants management systems, in the SSHRC Manual for Adjudication Committee Members, and in other pertinent material provided throughout the application and review process. Information pertaining to the protection and disclosure of personal information can also be found on SSHRC’s website, for both Grants and Fellowships and Scholarships.
In addition, merit review committee members, external reviewers and observers are advised of their responsibilities in relation to the Privacy Act and are required to sign a conflict of interest and confidentiality agreement to ensure that the material supplied and used throughout the review process is maintained in strict confidence at all times.
SSHRC’s president and senior management are kept informed of key decisions and developments in the administration and implementation of the act, as appropriate. The ATIP office provides a bi-monthly report to the executive vice-president, Corporate Affairs, and the president. This bi-monthly report enumerates current formal or informal requests under the Privacy Act, describes any privacy breaches and mitigation measures, and any complaints to the Office of the Privacy Commissioner.
When advice on the administration of the act is required, it is sought from one or several of the following: the Treasury Board of Canada Secretariat, Department of Justice legal counsel, the Office of the Privacy Commissioner (OPC), SSHRC’s ATIP consultant and other federal government ATIP offices.
Privacy Act Delegation Order
A copy of SSHRC’s delegation order for the Privacy Act is attached. The order—with the exception of paragraphs 8(2)(e) and 8(2)(m), which are reserved for the president, executive vice-president, and the executive director, Corporate Strategy and Performance—states that the persons holding the positions of Executive Vice-President; executive director, Corporate Strategy and Performance; andmanager, ATIP and Corporate Operations, are designated to exercise or perform all of the powers, duties and functions of the head of a government institution under the act, insofar as they may be exercised or performed in relation to SSHRC.
Statistical Report for Fiscal Year 2015-16
The statistical report for the period of April 1, 2017, to March 31, 2018 is appended.
One formal requests was received during the reporting period. This is one fewer than was received in 2016-2017. It is also slightly lower than the average of two formal requests per year over the last four fiscal years.
Three requests were closed during the reporting period.
One informal request for access to personal information was received and processed by the ATIP office over the course of the fiscal year. SSHRC normally receives a higher number of informal requests compared to the number of formal requests. No consultations from other government institutions or organizations were received by SSHRC in the fiscal year.
Education and Training
Throughout the year, staff and management are reminded and encouraged to consult the ATIP office on any issues that might affect the implementation of the act when and where appropriate.
During 2017-18, the manager, ATIP and Corporate Operations, initated a new training protocol for SSHRC staff. Instead of implementing a standing annual training session open to all SSHRC staff, the manager presented an updated training session to six of SSHRC’s seven divisions. During these sessions, approximately 85 SSHRC staff received training, which covered the principles of the privacy legislation, key concepts and definitions, SSHRC’s procedures for processing both formal and informal privacy requests, and employee responsibilities with respect to the act. SSHRC added the in-house training session to the Management Accreditation Roadmap for 2017-18.
SSHRC’S New or Revised Policies, Guidelines and Procedures Related to Privacy
A privacy protcol was introduced within the Tri-agency Institutional Programs Secretariat regarding to the handling of equity, diversity and inclusion self-identfication data. SSHRC’s ATIP staff have worked with staff in the Research Programs Directorate to develop and enhance text relating to privacy in numerous memorandums of understanding, especially in relation to joint-funding initiatives.
SSHRC is implementing a two-year project to update its Info Source chapter and personal information banks, scheduled to end June 2018. This project will ensure complete transparency in how SSHRC collects, uses and discloses personal information.
Complaints and Investigations
No complaints with respect to the Privacy Act was filed with the Office of the Privacy Commissioner of Canada during the fiscal year 2017-18.
SSHRC experienced no court challenges related to privacy during the reporting period.
SSHRC experienced no audits relating the administration of ATIP legislation during the reporting period.
Monitoring Processing Times
The executive director, Corporate Strategy and Performance was regularly kept apprised (normally on a weekly basis) by the manager, ATIP and Corporate Operations of all matters and developments pertaining to requests, including processing time, consultations undertaken and any necessary extensions.
Material Privacy Breaches
No material privacy breaches occurred during the reporting period.
Privacy Impact Assessments
While SSHRC did not complete any privacy impact assessments (PIAs) in the 2017-18 fiscal year, a PIA on the Canada 150 Research Chairs Program was launched. The Management Response and Action Plan has been approved, and SSHRC’s ATIP staff hope to implement improvements that include the consolidation and maturation of SSHRC’s privacy policies and practices in 2018-19. It is anticipated that the PIA will be formally submitted to Treasury Board Secretariat and the Privacy Commissioner in the first quarter of the 2018-19 fiscal year, along with an updated personal information bank, signalling the completion of the process. A full description will be provided in next year’s report.
Disclosures Under Subsection 8(2) of the Privacy Act
During the reporting period SSHRC made no disclosures pursuant to paragraph 8(2)(m) of the act, which pertains to disclosures of personal information in instances where there is a public interest in the disclosure or where disclosure would benefit the individual involved.