Annual Report on the Privacy Act 2021–2022

Annual Report on the Privacy Act 2021–2022 [PDF 3919 KB]

ISSN 2563-3104

Copyright/Permission to Reproduce

About the Canada Energy Regulator

The Canada Energy Regulator regulates infrastructure to ensure safe and efficient delivery of energy to Canada and the world, protecting the environment, recognizing, and respecting the rights of the Indigenous peoples of Canada, providing timely and relevant energy information and analysis. The Minister of Natural Resources is responsible for this organization.

The CER ensures that energy adjudication processes are fair, timely, transparent, and accessible. We prevent harm to people and the environment throughout the lifecycle of energy-related activities. Canadians have access to relevant energy and pipeline information for knowledge, research or decision-making. Feedback provided by stakeholders and Indigenous peoples informs our decisions and our work. The right governance, resources, management systems, programs and services are in place to deliver our program results.

For more information about the CER please visit our website.

The Privacy Act

The Privacy Act (the Act) gives individuals the right of access to information about themselves held by the federal government, with certain specific and limited exceptions. The Act protects an individual's privacy by setting out provisions related to the collection, retention, use and disclosure of personal information.

In accordance with section 72 of the Act, the head of every federal institution is required to submit an Annual Report to Parliament on the administration of the Act following the close of each fiscal year. The Annual Reports are then tabled in Parliament pursuant to section 72 of the Act. This report describes how the Canada Energy Regulator (CER) fulfilled its privacy responsibilities during the fiscal year 2021–22.

Organizational Structure

Privacy requests at the CER are processed by the ATIP Office, as part of the Open Government team which reports to the Vice President (VP), Data and Information Management, as the ATIP Coordinator.

Privacy requests are received primarily through two channels; through the mail or the ATIP Online Request Service (AORS), which was established in late 2018. Requests received through the mail are logged into the CER’s records management system by the Data & Information Management department and then forwarded to the ATIP Office.

As of the end of 2021–22, the CER has 4 full- time employees who allocated a portion of their time to activities related to the Act. This includes the Group Leader ATIP, two ATIP Officers, and one ATIP Administrator.

Delegation Order

The CER Act designates the CER CEO with the authority to exercise the powers, duties and functions of the Act. The CEO has historically delegated this authority.

The ATIP Office reports to the VP, Data and Information Management to who the CER CEO’s authority under the Act has been delegated.

The delegation order remained the same as the previous reporting year. Under the current order, there are three Vice President positions that have been delegated full authority under the Act. They are: the VP, Data and Information Management (primary ATIP Coordinator), the VP, Regulatory Strategy and Coordination and the VP, Performance and Results (alternate ATIP Coordinators). From an operational standpoint, granting this authority to three individuals ensures that files can be reviewed and signed- off without undue delay.

See annex B for a copy of the delegation orders.

Performance 2021–2022

In 2021–22, the CER received six new requests under the Act and carried forward one outstanding request from the previous reporting period.

Of the four closed requests to which responses were given during this period, three requests or 75% were completed within the legislated 30-day timeline. The last request took more than 365 days to complete and in the end was abandoned.

Over the past three years the CER has received very few privacy requests, however one of those requests contained more than 2,200 pages to be processed, making the workload associated with the Privacy Act substantial for a small organization.

The CER did not receive any consultations from other institutions or organizations.

During 2021–22, the CER ATIP Office incurred $14,512 in salary costs and $0 in goods and services costs to administer the Act.

In 2021–22, the CER closed 4 requests. Of the requests closed during the reporting period, records for 25% were fully disclosed, 25% were disclosed in part, and 50% were abandoned.

During the COVID-19 pandemic, all work was conducted remotely, with minimal operational disruption, and a slight increase in processing time.

See annex A for further statistical information.

Training and Awareness

Awareness was an area of focus for the CER’s ATIP Office this year. Direct outreach in the form of training sessions and presentations was used. The COVID work from home environment and new technologies presented unique concerns related to meeting recordings. Specific guidance was drafted and communicated widely including the principle of meaningful consent. In addition to promoting privacy awareness through in-person online training, the ATIP Office also delivered refresher presentations on the Privacy Act.

Training on the Access to Information Act and the Privacy Act was also offered by the ATIP Office which delivers both specialized training to respond to the needs of officers and clients, and general training to raise employees’ awareness of their responsibilities under these Acts. In this regard, the CER reviewed its ATIP training materials (i.e. tasking email, PowerPoint presentation, ATIP Tips Sheet, etc.) towards improving its training and communications with CER leadership and staff.

During 2021–22, the CER continued to require that all CER staff and contractors successfully pass the Access to Information and Privacy Fundamentals – I015 course offered by the Canada School of Public Service (CSPS). During this reporting period, 45 CER employees and 30 contractors registered for the course with 66 completing it successfully.

The ATIP Office anticipates that increased awareness of the Act amongst employees will improve their ability to collect records, help them better identify information for potential redaction, and enable them to better support the ATIP Office’s processing of requests. The ultimate goal being release packages that are responsive to requesters.

Training also focused heavily on employees’ obligations under the Privacy Act with respect to protection of personal information. This was a considerable focus area for the ATIP Office this year, in light of a continued uptick in privacy breaches (discussed further on page 9). In this regard, the CER also reviewed its internal privacy breach procedures and practices to ensure CER staff are aware of their obligations in the event of a privacy breach. The CER uses TBS’ privacy breach management procedures and available suite of tools to assist in managing breaches.

The CER’s ATIP Officers received training by attending webinars offered by the Treasury Board‘s Information and Privacy Policy Department. The ATIP Office also participated in this year’s Right to Know week.

Policies, Guidelines, Procedures and Initiatives

Documentation and training materials on the CER ATIP program were updated and made available through the corporate intranet, along with links to other materials, such as the Acts, Treasury Board Secretariat policies and guidance documents, and a range of information management and guidance tools.

The CER adopted Treasury Board’s privacy breach management guidelines and further integrated this approach into the CER’s processes. Recommended improvements have been submitted to adjacent policies such as the Policy on Security Management.

The CER continued to examine its ATIP procedures in an effort to enable continuous improvement and to identify opportunities for efficiencies in processing access to information and privacy requests.

Summary of Key Issues and Actions Taken on Complaints

During 2021–22, there were no new complaints registered with the Office of the Privacy Commissioner. As always, the CER will continue to work closely with the Office of the Privacy Commissioner to resolve any complaints in a timely and efficient manner.

No appeals were made to the Federal Court of Canada during 2021–22.

Monitoring Compliance

The CER achieved a compliance rating of 75% for completed privacy requests closed within the legislated timeframe in 2021–22. The CER processed a total of 2,336 pages and disclosed 1,897 pages to requesters

With regard to the timeliness of processing privacy requests, the ATIP Office regularly communicates progress updates to the ATIP Coordinator through the ATIP Group Leader. The ATIP Group Leader receives weekly updates from the ATIP Office regarding the status of all active requests and has access to a central tracker that is updated on a regular basis to establish action items or flag upcoming due dates.

Material Privacy Breaches

There were eight investigations undertaken by the CER’s ATIP Office during 2021–22, and seven of them were determined to be privacy breaches. Five incidents were emails containing personal information sent to wrong addresses, and two were related to personal information contained on invoices. All instances were determined to be non-material breaches. Notices to impacted parties were sent in all cases but due to their minor nature, the reports were not shared any further.

In all instances, the ATIP Office applied the Treasury Board’s privacy breach management procedures and worked with the relevant Office of Primary Interest and ATIP Coordinator to identify and implement administrative measures to mitigate the potential for future incidents. Overall, these incidents have helped the CER improve its handling and classification of personal information, as well as its information management practices.

Privacy Impact Assessments

During the 2021–22 reporting period, no privacy impact assessments were completed.

The CER posts summaries of completed privacy impact assessments on its external website and forwards copies of completed assessment reports to the Office of the Privacy Commissioner.

Public Interest Disclosures

The CER did not disclose any personal information under paragraphs 8(2)(e) or (m) of the Privacy Act.

Annex A – Statistical Information

Statistical Report on the Privacy Act

Name of institution: Canada Energy Regulator

Reporting period: 4/1/2021 to 3/31/2022

Section 1: Requests Under the Privacy Act

1.1 Number of requests received

1.2 Channels of requests

Section 2: Informal requests

2.1 Number of informal requests

2.2 Channels of informal requests

2.3 Completion time of informal requests

2.4 Pages released informally

Section 3: Requests Closed During the Reporting Period

3.1 Disposition and completion time

3.2 Exemptions

3.3 Exclusions

3.4 Format of information released

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper and e-record formats

3.5.2 Relevant pages processed by request disposition for paper and e-record formats by size of requests

3.5.3 Relevant minutes processed and disclosed for audio formats

3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests

3.5.5 Relevant minutes processed and disclosed for video formats

3.5.6 Relevant minutes processed per request disposition for video formats by size of requests

3.5.7 Other complexities

3.6 Closed requests

3.6.1 Number of requests closed within legislated timelines

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines

3.7.2 Request closed beyond legislated timelines (including any extension taken)

3.8 Requests for translation

Section 4: Disclosures Under Subsections 8(2) and 8(5)

Section 5: Requests for Correction of Personal Information and Notations

Section 6: Extensions

6.1 Reasons for extensions

6.2 Length of extensions

Section 7: Consultations Received From Other Institutions and Organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada

Section 8: Completion Time of Consultations on Cabinet Confidences

8.1 Requests with Legal Services

8.2 Requests with Privy Council Office

Section 9: Complaints and Investigations Notices Received

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

10.1 Privacy Impact Assessments

10.2 Institution-specific and Central Personal Information Banks

Section 11: Privacy Breaches

11.1 Material Privacy Breaches reported

11.2 Non-Material Privacy Breaches reported

Section 12: Resources Related to the Privacy Act

12.1 Allocated Costs

12.2 Human Resources

Note: Enter values to three decimal places.

Supplemental Statistical Report on the Access to Information Act and the Privacy Act

Name of institution: Canada Energy Regulator

Reporting period: 2021-04-01 to 2022-03-31

Section 1: Capacity to Receive Requests under the Access to Information Act and the Privacy Act

Enter the number of weeks your institution was able to receive ATIP requests through the different channels.

Section 2: Capacity to Process Records under the Access to Information Act and the Privacy Act

2.1 Enter the number of weeks your institution was able to process paper records in different classification levels.

2.2 Enter the number of weeks your institution was able to process electronic records in different classification levels.

Section 3: Open Requests and Complaints Under the Access to Information Act

3.1 Enter the number of open requests that are outstanding from previous reporting periods.

3.2 Enter the number of open complaints with the Information Commissioner of Canada that are outstanding from previous reporting periods.

Section 4: Open Requests and Complaints Under the Privacy Act

4.1 Enter the number of open requests that are outstanding from previous reporting periods.

4.2 Enter the number of open complaints with the Privacy Commissioner of Canada that are outstanding from previous reporting periods.

Section 5: Social Insurance Number (SIN)

Top of Page

Annex B – Delegation Order

Delegation of Authority pursuant to the Access to Information Act and the Privacy Act

I, the Chief Executive Officer of the Canada Energy Regulator, pursuant to section 95(1) of the Access to Information Act^Footnote 1 and section 73(1) of the Privacy Act^Footnote 2, hereby designate the persons holding the positions set out in the Delegation of Authority Schedule attached hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Chief Executive Officer of the Canada Energy Regulator under the provisions of the Acts and related regulations set out in the schedule opposite each position. This designation supersedes all previous delegation orders.

Dated at the City of Calgary, in the Province of Alberta, this 16^th day of February 2021.

______________________________
Gitane De Silva
Chief Executive Officer

Delegation of Authority Schedule

Date modified:

2023-11-27