Privacy Act - CRTC Annual Report - 2024-2025

Introduction

The Canadian Radio-television and Telecommunications Commission (CRTC) is pleased to present its Annual Report to Parliament, in accordance with section 72 of the Privacy Act (the Act). The report describes the activities that support compliance with the Act for the reporting period commencing April 1, 2024, and ending March 31, 2025.

The Purpose of the Privacy Act

Section 2 of the Act sets out its purpose, which is to protect the privacy of individuals with respect to personal information about themselves held by a government institution and to provide individuals with a right of access to that information.

The Act also protects against unauthorized disclosure of that personal information and strictly controls how the government will collect, use, store, disclose, and dispose of any personal information.

CRTC Mandate and Responsibilities

The CRTC is an independent quasi-judicial tribunal that regulates the Canadian communications sector in the public interest. The CRTC holds public consultations on telecommunications and broadcasting matters and makes decisions based on the public record.

The CRTC operates under several legislative authorities and Acts of Parliament. These include the following: the Canadian Radio-Television and Telecommunications Commission Act, the Bell Canada Act, the Broadcasting Act, the Telecommunications Act, Canada’s Anti-Spam Legislation, the Accessible Canada Act, the Online News Act, and the Canada Elections Act, which includes provisions that established the Voter Contact Registry.

The CRTC’s role includes consulting Canadians on communication issues of importance, making decisions and rules, responding to inquiries and complaints, as well as reporting to Canadians on the progress and outcomes of our work. The CRTC promotes and enforces compliance with its regulatory policies and decisions. It encourages and facilitates industry co-regulation and self-regulation through consultations, committees and working groups with various industry stakeholders. The CRTC also plays a key role in resolving industry disputes.

Finally, in the current dynamic and evolving communications environment, the CRTC collaborates with various domestic and international stakeholders to leverage capacity and intelligence on a host of interrelated policy issues and questions.

The CRTC delivers its mandate from offices in the National Capital Region and regional offices throughout Canada.

Organizational Structure

The CRTC’s Access to Information and Privacy (ATIP) Office operates under the Information Management and Information Technology Directorate and reports directly to the Chief Information Officer, Chief Data Officer.

When fully staffed, the CRTC ATIP Office has eight indeterminate employees and one student. Of these eight employees, seven are devoted full-time to the administration of the Acts, and one is dedicated to administrative support for the ATIP team. For the 2024–2025 reporting period, the positions staffed relating to the Privacy Act equalled 0.400 Full-Time Equivalent (FTE), including 0.200 from part-time/casual employee. The ATIP office does not have any regional employee.

In 2024–2025, the CRTC ATIP Office incurred an estimated $40,530 in salary costs for the processing of requests received pursuant to the Act. These costs do not include the resources expended by the program areas of the CRTC to meet the requirements of the Act.

Delegation Order

The Chairperson and Chief Executive Officer of the CRTC issued a formal Delegation Order under the authority of section 73(1) of the Privacy Act.

Through this Delegation Order, the Chairperson delegates the authority to exercise and perform the powers, duties, and functions conferred upon her as the head of the government institution under the Privacy Act. The delegation applies to the individuals occupying the positions specified in the attached schedule. These delegated authorities specifically pertain to the administration and compliance responsibilities under the Privacy Act.

This Delegation Order supersedes all previous delegation orders related to the CRTC, either in whole or in part.

The Delegation Order was signed and came into effect on July 25, 2023.

A signed copy of the delegation can be found in Annex A.

Performance 2024–2025

Section 1: Requests under the Privacy Act

Number of requests

In the 2024–2025 reporting period, the CRTC ATIP Office carried over one request from 2023–2024 and received 19 new requests for a total of 20 requests. This is more than triple the six requests recorded in the previous reporting period.

Section 2: Requests closed during the reporting period

Disposition and completion time

In 2024–2025, a total of 19 requests were closed. Of these, 13 resulted in a “No records exist” response and all were closed within 0 to 15 days. Additionally, a total of four requests were abandoned by the applicants: two within the 0 to 15-day timeframe, one between 16 to 30 days and one within 31 to 60 days. There were two requests for which records were disclosed in part, both of which were closed in 31 to 60 days.

In 2023–2024, of the six requests closed, two were disclosed in their entirety, one was disclosed in part, and three had no records.

Exemptions and exclusions

Sections 18 through 28 of the Act set out the exemptions that can be applied to withhold disclosure information pertaining to a particular public or private interest. The CRTC used two exemptions; section 26, which protects information about another individual and section 27, which protects personal information due to solicitor-client privileges.

Similar to the previous year, no exclusions were used by the CRTC in response to privacy requests.

Format of information released

In 2024–2025, two files were released in electronic format, whereas in 2023–2024, three files were released in electronic format.

Section 2.1: Complexity

Relevant pages processed and disclosed

In 2024–2025, a total of 1,541 pages were processed which represents a significant increase of 817% compared to 2023–2024, and 507 pages were released which also represents an increase of 299% compared to the previous year.

Relevant pages processed and disclosed by size of requests

In 2024–2025, out of the 19 files that were closed, two resulted in partial disclosures: one involved over 400 pages processed with almost 200 disclosed; and the other involved nearly 1,000 pages processed with over 300 disclosed. Additionally, one request was abandoned by the applicant after 103 pages had been processed.

In the previous reporting period 2023–2024, of the six closed files, three contained records, with an average of 56 pages per file.

Other complexities

In 2024–2025, there were no files that reflected other complexities.

Section 2.2: Closed requests

During the 2024–2025 reporting period, all 19 closed requests were completed within the legislated timelines, resulting in a 100% compliance rate. In contrast, the 2023–2024 period saw five of six requests closed on time, yielding an 83% compliance rate. This represents a 20% compliance rate improvement year over year and underscores ongoing efforts to meet legislative requirements despite the increased workload.

Section 2.3: Deemed refusals

Reasons for not meeting legislative timelines

In 2024–2025, the CRTC had no complaints for deemed refusals.

Requests for translation

There were no requests for translation in the reporting period.

Section 3: Disclosures under Subsections 8(2) and 8(5)

Subsection 8(2) of the Act states that subject to any other Act of Parliament, personal information under the control of a government institution may be disclosed if it meets the conditions listed in paragraphs (a) to (m).

In addition, as written in subsection 8(5), the head of the government institution shall notify the Privacy Commissioner in writing of any disclosure of personal information under paragraph 8(2)(m) prior to the disclosure. There were no disclosures under section 8(2)(m) during the reporting period. During this reporting period, the CRTC received no requests where the records were released pursuant to subsections 8(2) and 8(5) of the Act.

Section 4: Requests for correction of personal information and notations

In 2024–2025, similar to the previous year, no requests for correction of personal information were received or processed within the reporting period.

Section 5: Extensions

Reasons for extensions and disposition of requests

The Act allows departments to extend the legislated deadline of a request if it cannot be completed within the legislated 30-day time limit.

Section 15 of the Act permits extensions if:

• Section 15(a)(i): Meeting the original time limit would unreasonably interfere with the operations of the government institution;
• Section 15(a)(ii): Consultations, including for Cabinet Confidences, are necessary to comply with the request and cannot reasonably be completed within the original time limit;
• Section 15(b): Additional time is necessary for translation purposes or for the purpose of converting the personal information into an alternative format.

Length of extensions

In 2024–2025, among the 19 requests received, three extensions were taken for unreasonable interference with operations.

Section 6: Consultations

Consultations received from other institutions and organizations

No consultations from another Government of Canada Institution or from other organizations were received during the reporting period.

Consultations on Cabinet Confidences

Requests with Legal Services

No requests related to Cabinet Confidences were sent to Legal Services during the reporting period.

Requests with Privy Council Office

No requests related to Cabinet Confidences were sent to the Privy Council Office during the reporting period.

Section 7: Complaints and Investigations

In 2024–2025, there were no complaints received (section 31), and there were no outstanding privacy complaints from the previous year.

Privacy Impact Assessments (PIA)

No PIAs were completed during the reporting period.

Training

Throughout the 2024–2025 reporting period, the CRTC ATIP Office delivered a training session to all CRTC employees and management. The office continues to emphasize the roles and responsibilities of all staff under the Act, providing ongoing one-on-one support through individual meetings.

During the same period, the CRTC ATIP Office undertook an assessment of training needs. This involved consultation with various sectors to identify key areas for development. The goal is to create a comprehensive training program that is accessible to all CRTC employees.

The CRTC intranet, available to all employees, hosts a dedicated section outlining the ATIP Office’s roles and responsibilities as well as providing information on the Act and related CRTC policies and procedures. The CRTC ATIP Office remains committed to exploring new strategies to enhance awareness across the Commission.

Policies, guidelines and procedures

Info Source

Info Source is a series of publications that provide details on the Government of Canada and its data collection activities. It supports public access to information and the exercise of rights under the Privacy Act and Access to Information Act.

The CRTC’s Info Source is available on its website, which also offers information on the CRTC’s policies, structure, and contact details. In line with federal proactive disclosure requirements, the site includes travel and hospitality expenses, contracts, job reclassifications, completed access request summaries, and briefing material titles.

The CRTC ATIP Office maintains an internal manual to ensure consistent practices and support new analysts.

Complaints

In 2024–2025, no complaints were received. There were also no outstanding complaints from the previous year.

Monitoring Compliance

The CRTC is committed to responding to every Privacy request completely and in a timely manner. Therefore, the ATIP team leader holds weekly meetings with analysts to review on-time performance and meets with subject matter experts to receive status updates on outstanding files and retrievals.

Privacy breaches

The CRTC did not experience any material privacy breaches over the reporting period.

Public interest disclosure

Paragraph 8(2)(m) of the Act allows the head of the institution to disclose personal information without the consent of the affected individual in cases where, in the opinion of the head, the public interest outweighs any invasion of privacy that could result from the disclosure or when it is clearly in the best interest of the individual to disclose.

During the reporting period, CRTC made no disclosure of personal information under this provision.

Appendix A: Delegation Order

Privacy Act Delegation Order

I, the undersigned, Chairperson and Chief Executive Officer of the Canadian Radio-Television and Telecommunications Commission (CRTC), pursuant to section 73 (1) of the Privacy Act*, hereby delegate the person or persons holding the position or positions set out in the schedule hereto to exercise and perform the powers, duties and functions of the Chairperson and Chief Executive Officer, as the head of the government institution, under the sections of the Act set out in the attached schedule for each position.

This Delegation Order supersedes all previous Delegation Orders with respect to the CRTC, or any portion thereof.

*R.S.C. 1985, Ch. P-21