2023-2024 Annual Report to Parliament on the Privacy Act

1. Introduction

The Privacy Act provides Canadian citizens and people present in Canada the right of access to, and correction of, information about them that is held by the federal government. It also protects against unauthorized disclosure of that personal information. In addition, it strictly controls how the government will collect, use, store, disclose, and dispose of any personal information.

This report summarizes the activities of CanNor in implementing the Act, for the period of April 1, 2023 to March 31, 2024, and fulfils the requirement under Section 72, which stipulates that the head of every government institution shall prepare for submission to Parliament an annual report on the administration of this Act within the institution during each financial year.

CanNor works with partners to advance economic development in Canada's territories. The Agency supports, invests in and advocates for national, territorial and community level economic development; fosters growth and innovation; contributes to building capacity; and invests in foundational economic development projects in the territories. In addition, through the Northern Projects Management Office the Agency coordinates federal participation in the territorial environmental review processes and maintains the Crown consultation record for major projects.

The Agency works closely with all federal partners to advance a whole of government approach to economic development in the territories.

CanNor supports the implementation of the Government of Canada priorities and the mandate letter for the Minister of Northern Affairs, Minister Responsible for Prairies Economic Development Canada and Minister responsible for the Canadian Northern Economic Development Agency.

2. Organizational Structure

For the purposes of the Privacy Act, the President of CanNor has delegated powers, duties and functions under the Act to the Corporate Secretary who performs the role of ATIP Coordinator responsible for leading the ATIP Program. The ATIP Coordinator administers the Act with the assistance of a part-time Administrative Officer. During the reporting period, CanNor was not party to any service agreements under section 73.1 of the Privacy Act.

The ATIP Coordinator is accountable for the development, coordination, and implementation of effective policies, guidelines, systems, and procedures to meet responsibilities under the Act, and to permit processing requests, and disclosure of information. Additionally, the ATIP Coordinator provides strategic support and advice to the executive management of the Agency regarding the administration of the ATIP Program, and is responsible for all Privacy Activities and operations pursuant to the Act such as:

• processing and responding to all formal requests and interdepartmental consultations under the Privacy Act;
• providing strategic advice to the Agency about privacy-related issues;
• preparing guidance documents in support of privacy legislation;
• updating and registering personal information banks;
• preparing the Annual Report to Parliament on the Privacy Act;
• training employees on their roles and responsibilities under the Privacy Act; and,
• processing and responding to informal inquiries.

3. Delegation Order

The President's Privacy Delegation Order (Annex A), was updated on December 11, 2023. It provides delegated authority to the Corporate Secretary and the Manager, IM/IT and Chief Information Officer.

4. Performance 2023-2024

CanNor's 2023-2024 Statistical Report on the Privacy Act is attached as Annex B. The following is an overview of key data on CanNor's performance for the fiscal year:

5. Training and Awareness

Formal training was conducted during the CanNor Administrative Professionals Annual Training Meeting in January, 2024. This session captured all sectors of CanNor and focused on record collection, internal processes, timelines and exemptions. In addition, informal briefings were provided to CanNor Middle Managers on the administration of the Privacy Act. These were conducted one-on-one as needed via in person or online video meetings and telephone calls.

6. Policies, Guidelines and Procedures

CanNor did not implement or amend any institution-specific Privacy policies, guidelines, or procedures during the reporting period. The Agency did not receive authority for any new collections or new consistent uses of Social Insurance Numbers during the reporting period.

7. Initiative and Projects to Improve Privacy

In addition to providing enhanced training to employees and managers on implementing the Privacy Act, the agency actively employs TBS approved technological tools, including Access Pro Case Management and the ATIP on-line portal, to efficiently process requests.

8. Summary of Key Issues and Actions Taken on Complaints or Audits

There were no complaints received concerning the administration of the Privacy Act, and no audits, investigations or appeals to the Federal Court were undertaken.

9. Material Privacy Breaches

CanNor reported no internal material privacy breaches to the Office of the Privacy Commissioner during the 2023-2024 reporting period.

The CanNor ATIP Program was advised by the Treasury Board Secretariat (TBS) of two specific large scale material privacy breaches within third party delivery agents of the government. As a result, the Agency participated in information sessions, the dissemination of notices to employees, and activated the CanNor privacy breach response committee, to evaluate potential impact and required processes, as directed by TBS regarding the external to CanNor privacy breaches.

In 2023-24 CanNor ATIP directorate had a total operating cost to administer the Privacy Act of $26,000, as compared to $2,000 in 2022-23, broken down as follows: a 0.2 of 1 full-time equivalent employee salary. The increase can be directly attributed to supporting the Treasury Board Secretariat (TBS) during the two material breaches incurred by the government's third party delivery agents.

10. Privacy Impact Assessments

During the reporting period, CanNor did not complete any Privacy Impact Assessments and no assessments were forwarded to the Office of the Privacy Commissioner.

11. Public Interest Disclosures

There were no disclosures pursuant to paragraph 8(2)(m) for the 2023-2024 period.

12. Monitoring Compliance

As the official responsible for completion timelines, the Corporate Secretary and ATIP Coordinator is made aware of new and outstanding requests on a continual basis. A shared request database is used when processing Privacy requests which tracks deadlines and allows for effective monitoring.

Annex A – Privacy Act Delegation Order

Pursuant to the powers of designation conferred upon me by Section 73(1) of the Privacy Act, the persons exercising the functions or positions of Manager, IM/IT and Chief Information Officer (position number 000139900), and Corporate Secretary (position number 146270) and their respective successors, including in their absence, a person or officer designated in writing to act in the place of the holder of any such functions or positions are hereby designated to exercise those powers, duties or functions of the President as the Head of the government institution under the Act, and as set out in Schedules A and B.

President - Canadian Northern Economic Development Agency
Dated at Ottawa, the 11th of December, 2023

Annex B - Statistical Report on the Privacy Act

Reporting period: April 1, 2023 to March 31, 2024