Privacy Act - CRTC Annual Report - 2023–2024

Introduction

The Canadian Radio-television and Telecommunications Commission (CRTC) is pleased to present its Annual Report to Parliament, in accordance with section 72 of the Privacy Act (the Act). The report describes the activities that support compliance with the Act for the fiscal year commencing April 1, 2023, and ending March 31, 2024.

The Purpose of the Privacy Act

Section 2 of the Act sets out its purpose, which is to protect the privacy of individuals with respect to personal information about themselves held by a government institution, and to provide individuals with a right of access to that information.

It also protects against unauthorized disclosure of that personal information. In addition, it strictly controls how the government will collect, use, store, disclose, and dispose of any personal information.

CRTC Mandate and Responsibilities

The CRTC is an independent quasi-judicial tribunal that regulates Canada’s communications system in the public interest.

The CRTC operates under several legislative authorities and Acts of Parliament. These include the following: the CRTC Act, the Bell Canada Act, the Broadcasting Act, the Telecommunications Act, Canada’s Anti-Spam Legislation, the Accessible Canada Act, the Online News Act and the Canada Elections Act, which includes provisions that established the Voter Contact Registry.

The CRTC’s role includes consulting Canadians on communication issues of importance to them, making decisions and rules, responding to enquiries and complaints, as well as reporting to Canadians on the progress and outcomes of our work. The CRTC promotes and enforces compliance with its regulatory policies and decisions. It encourages and facilitates industry co-regulation and self-regulation through consultations, committees and working groups with various industry stakeholders. The CRTC also plays a key role in resolving industry disputes. Finally, in the current dynamic and evolving communication environment, the CRTC collaborates with various domestic and international stakeholders to leverage capacity and intelligence on a host of interrelated policy issues and questions.

The CRTC delivers its mandate from offices in the National Capital Region and regional offices throughout Canada.

Organizational Structure

The CRTC’s Access to Information and Privacy (ATIP) Office is located within the Information Management section of the Information Management and Information Technologies Directorate. When fully staffed, the CRTC ATIP Office has six indeterminate employees.

The activities of the CRTC ATIP Office include:

• publishing all proactive disclosure;
• receiving and processing requests in accordance with the Act;
• promoting awareness of the Act within the CRTC;
• preparing the annual reports to Parliament, the annual statistical report and maintaining the Department’s Info Source chapter;
• monitoring CRTC compliance with the Act; and
• providing professional advice and guidance to senior management and all CRTC staff on the Act.

The CRTC ATIP Office uses the AccessPro Case Management system and an imaging and electronic redaction software solution, AccessPro Redaction. The Office works closely with 14 departmental ATIP liaison officers who are appointed by the sectors. The liaison officers are responsible for ensuring that requests tasked to their groups are handled promptly and that relevant records are forwarded to the CRTC ATIP Office on time.

In 2023–2024, the CRTC has not entered into any service agreements pursuant to section 73.1 of the Act.

Delegation Order

Decision-making responsibility for the application of the various provisions of the Act has been formally established and is outlined in the Delegation Order approved by the Chairperson and CEO of the CRTC on July 25, 2023. A copy of the Delegation Order is in Appendix A of this Report.

Performance 2023–2024

Section 1: Requests under the Privacy Act

1.1 Number of requests

The CRTC received six new requests in the reporting period, which represents a 15% decrease compared to the previous year where seven requests were received. One request was carried forward from the previous reporting period.

Section 2: Requests Closed During the Reporting Period

2.1 Disposition and completion time

In 2023–2024, of the six requests received and one carried forward, 0 were closed within 15 days, three were closed within between 16 and 30 days, two were closed within 60 days, and one was closed within 120 days. In 2022–2023, of the eight requests closed, two were closed within 15 days, three were closed within between 16 and 30 days, one was closed within 60 days, and two were closed within 120 days.

In 2023–2024, of the six requests closed, two were disclosed in their entirety, 1 was disclosed in part, and three had no records. In 2022–2023, of the eight requests closed, two were disclosed in part, two had no records, and four were abandoned by the applicant.

2.2 Exemptions

Sections 18 through 28 of the Act set out the exemptions that can be applied to withhold disclosure information pertaining to a particular public or private interest. The CRTC used one exemption within two files; section 26, which protects information about another individual.

2.3 Exclusions

As in the previous year, no exclusions were used by the CRTC in response to the requests.

2.4 Format of information released

In 2023–2024, three files were released in electronic format. In 2022–2023, two files were released in electronic format.

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

In 2023–2024, 168 pages were processed, and 127 pages were released. In 2022– 2023, 400 pages were processed, and 379 pages were released.

2.5.2 Relevant pages processed and disclosed by size of requests

In 2023–2024, of the six files closed, three files had records with an average page count of 56 pages. In 2022–2023, of the eight files closed, six files had records with an average page count of 66.66 pages.

2.5.3 Other complexities

In 2023–2024, one of the requests contained interwoven information, meaning that the records contained the personal information of more than one individual. Legal advice was not sought.

2.6 Closed requests

In 2023–2024, five requests were closed within their legislative timelines, and one was closed past legislated timelines.

2.7 Deemed refusals

2.7.1 Reasons for not meeting legislative timelines

In 2023–2024, of the six closed requests, one was closed past legislated timelines due to interference with operations.

2.8 Requests for translation

There were no requests for translation in the reporting period.

Section 3: Disclosures under Subsections 8(2) and 8(5)

Subsection 8(2) of the Act states that subject to any other Act of Parliament, personal information under the control of a government institution may be disclosed if it meets the conditions listed in paragraphs (a) to (m).

In addition, as written in subsection 8(5), the head of the government institution shall notify the Privacy Commissioner in writing of any disclosure of personal information under paragraph 8(2)(m) prior to the disclosure. There were no disclosures under section 8(2)(m) during the reporting period.

In the course of this reporting period, the CRTC received no request where the records were released pursuant to subsections 8(2) and 8(5) of the Act.

Section 4: Requests for Correction of Personal Information and Notations

In 2023–2024, like the previous year, no requests for correction of personal information were received or processed within the reporting period.

Section 5: Extensions

5.1 Reasons for extensions and disposition of requests

The Act allows departments to extend the legislated deadline of a request if it cannot be completed within the legislated 30-day time limit. Section 15 of the Act permits extensions if:

• meeting the original time limit would unreasonably interfere with the operations of the government institution.
• consultations, including for Cabinet Confidences, are necessary to comply with the request and cannot reasonably be completed within the original time limit; or
• additional time is necessary for translation purposes or for the purpose of converting the personal information into an alternative format.

5.2 Length of extensions

In 2023–2024, among the six requests received, three extensions were taken for interference with operations.

Section 6: Consultations Received from Other Institutions and Organizations

No consultations from another Government of Canada institution or from other organizations were received during the reporting period.

Section 7: Consultations on Cabinet Confidences

7.1 Requests with Legal Services

No requests related to Cabinet Confidences were sent to Legal Services during the reporting period.

7.2 Requests with Privy Council Office

No requests related to Cabinet Confidences were sent to the Privy Council Office during this reporting period.

Section 8: Complaints and Investigations

In 2023–2024, there were no complaints received (section 31), and there were no outstanding privacy complaints from the previous year.

Section 9: Privacy Impact Assessments (PIA)

One PIA was completed during the reporting year 2023–2024. The PIA relates to the National Do Not Call List.

In addition, a Preliminary Privacy Impact Assessment (PPIA) was conducted to determine if a full PIA was required prior to undertaking a series of discussion sessions on the issues that the broadcasting industry faces to have music classified as Canadian Content. The purpose of these discussion sessions is to better inform the CRTC. The PPIA covered much of the same content as a core PIA, though at a different level of detail. The conclusion of the PPIA determined that a core PIA was not necessary prior to undertaking the discussion sessions.

Section 10: Resources Related to the Privacy Act

When fully staffed, the CRTC ATIP Office has six indeterminate employees, one of whom is devoted part-time to activities related to the Act.

During 2023–2024, the CRTC ATIP Office incurred an estimated $37,354 in salary costs to administer the Act. These costs do not include the resources expended by the program areas of the CRTC to meet the requirements of the Act.

Training

Over the course of the 2023–2024 fiscal year, the CRTC ATIP Office offered two training
sessions to all CRTC employees and management. Additionally, the CRTC ATIP office provided training to employees in individual sectors. The CRTC ATIP Office continues to promote the roles and responsibilities of all CRTC staff with respect to the Act and is continuously meeting with individuals to provide one-on-one support.

The CRTC intranet, which is accessible to all employees, includes a section that describes the CRTC ATIP Office’s roles and responsibilities and provides information on the Act and related Commission policies and procedures. The CRTC ATIP Office is constantly looking for new methods to increase awareness throughout the Commission and is working on an initiative to include items in the CRTC Weekly News distributed to all employees.

Institution Specific Policies, Guidelines and Procedures

The statistical report on the Act was provided to the Treasury Board Secretariat.

Complaints

In 2023–2024, no complaints were received. There were also no outstanding complaints from the previous year.

Monitoring of Processing Time

The CRTC is committed to responding to every request made under the Act completely and in a timely matter. Therefore, the CRTC ATIP Office holds weekly team meetings to review priorities and any potential issues. In addition, the ATIP Coordinator holds weekly meetings with analysts to review on-time performance, and weekly meetings with the Legal and other sectors to receive status updates on outstanding files and retrievals. In turn, the Office of the Secretary General raises any concerns with the Senior Management committee. This committee includes the Chairperson and CEO of the CRTC and all the sector heads that report directly to the CEO.

Privacy Breaches

The CRTC did not incur any material privacy breaches over the reporting period.

Privacy Impact Assessments (PIA)

One PIA was completed during the reporting year 2023–2024. The PIA relates to the National Do Not Call List.

Public Interest Disclosures

Paragraph 8(2)(m) of the Act allows the head of the institution to disclose personal information without the consent of the affected individual in cases where, in the opinion of the head, the public interest outweighs any invasion of privacy that could result from the disclosure or when it is clearly in the best interest of the individual to disclose.

During the reporting period, CRTC made no disclosure of personal information under this provision.

Appendix A: Delegation Order

Privacy Act Delegation Order

I, the undersigned, Chairperson and Chief Executive Officer of the Canadian Radio-Television and Telecommunications Commission (CRTC), pursuant to section 73 (1) of the Privacy Act*, hereby delegate the person or persons holding the position or positions set out in the schedule hereto to exercise and perform the powers, duties and functions of the Chairperson and Chief Executive Officer, as the head of the government institution, under the sections of the Act set out in the attached schedule for each position.

This Delegation Order supersedes all previous Delegation Orders with respect to the CRTC, or any portion thereof.

*R.S.C. 1985, Ch. P-21

Appendix C: Supplemental Statistical Report on the Access to Information Act and the Privacy Act

Supplemental Statistical Report on the Access to Information Act and the Privacy Act

Name of institution: Canadian Radio-Television and Telecommunications Commission

Reporting period: 2023-04-01 to 2024-03-31

Section 1: Open requests and complaints under the Access to Information Act

Row 11, Col. 3 of Section 1.1 must equal Row 7, Col. 1 of Section 1.1 of the 2023-24 Statistical Report on the Access to Information Act

Section 2: Open requests and complaints under the Privacy Act

Row 11, Col. 3 of Section 2.1 must equal Row 7, Col. 1 of Section 1.1 of the 2023-24 Statistical Report on the Privacy Act

Section 3: Social Insurance Number (SIN)

Section 4: Universal access under the Privacy Act