The Privacy Act (the Act) gives Canadian citizens and permanent residents of Canada the right of access to information about themselves held by the federal government, with certain specific and limited exceptions. The Act protects an individual's privacy by setting out provisions related to the collection, retention, accuracy, disposal, use and disclosure of personal information.
The Act requires the head of every federal government institution to submit an annual report to Parliament on the administration of the Act following the close of each fiscal year. This annual report is prepared and is being tabled before each House of Parliament in accordance with section 72 of the Act. This report summarizes how Health Canada has fulfilled its responsibilities under the Privacy Act during the fiscal year 2018–2019.
Health Canada is the federal department responsible for helping the people of Canada maintain and improve their health.
Health Canada is committed to improving the lives of all Canadians and to make this country's population among the healthiest in the world as measured by longevity, lifestyle and effective use of the public health care system.
By working with others in a manner that fosters the trust of Canadians, Health Canada strives to:
Health Canada has regional offices in British Columbia, Alberta, Saskatchewan, Manitoba, Ontario, Quebec, and the Atlantic and Northern Regions.
For more information about Health Canada, please visit our website.
Privacy protection and the appropriate management of personal information, including personal health information, are extremely important for Canadians and Health Canada. The Department takes its role in the management of personal information seriously and has taken steps to raise awareness and implement processes to comply with the Privacy Act. These are outlined in this report.
Privacy Act requirements are led out of the Privacy Management Division ( PMD ) and the Access to Information and Privacy ( ATIP ) Division. Both Divisions reside in the Planning, Integration and Management Services Directorate of the Corporate Services Branch at Health Canada.
In 2018–2019, the Act was administered at Health Canada by 14.3 full-time equivalent ( FTE ) employees with the support of 3.07 FTE s in consultant services, as well as part-time and casual employees of 1.22 FTE s, for a total resource complement of 18.59 FTE s. These figures include administrative support, management, reporting, monitoring and policy resources, and overhead cost, which contribute to the overall support of the operations of the application of the Act.
The Privacy Management Division’s core functions include ensuring compliance of Health Canada program delivery with the Privacy Act and Treasury Board policies and directives. Responsibilities include:
The management of requests and associated complaints under the Privacy Act is jointly led by the Access to Information and Privacy Division and the Privacy Management Division. Together, these Divisions are responsible for legislative requirements pursuant to the Act such as:
The most recent delegation order for the Act, signed by the Minister of Health, is included in this report (Appendix A). In keeping with Treasury Board Secretariat recommendations on best practice, the delegation order extends authorities to multiple positions including the Coordinator, the Corporate Services Branch’s Assistant Deputy Minister and Director General of Planning Integration and Management Services Directorate. As appropriate, certain administrative authorities are delegated to various senior levels within the ATIP Division and Privacy Management Division to support the effective and efficient administration of the Act.
This section of the report includes an interpretation and explanation of the data contained in Health Canada’s statistical report that summarizes privacy-related activity for the period between April 1, 2018, and March 31, 2019 (Appendix B).
In 2018–2019, Health Canada received 219 Privacy Act requests, compared to 237 in 2017–2018, an 8% decrease. Many of these requests were for access to public servants’ medical records. Health Canada also received a significant number of requests from current and former Health Canada employees who wanted to obtain their personal information.
During the 2018–2019 fiscal year, Health Canada processed 215 of 268 active requests (80%). Active requests included 219 new requests and 49 requests carried forward from 2017–2018.
| Fiscal Year | Number of Requests Received | Number of Requests Carried Over | Total Caseload | Number of Requests Closed | # of Pages Reviewed for Closed Files |
|---|---|---|---|---|---|
| 2014–2015 | 532 | 79 | 611 | 543 | 81,385 |
| 2015–2016 | 531 | 68 | 599 | 549 | 36,748 |
| 2016–2017 | 269 | 50 | 319 | 279 | 13,305 |
| 2017–2018 | 237 | 40 | 277 | 228 | 8,608 |
| 2018–2019 | 219 | 49 | 268 | 215 | 21,612 |
In 2018–2019, Health Canada completed a total of five consultations (21 pages) from other federal government departments. No consultations were received from institutions outside of the federal government.
Number of Consultations and Pages Reviewed from Other Federal Institutions
| Federal Institutions | Number of Consultations Completed | Pages Reviewed |
|---|---|---|
| Canadian Border Services Agency | 2 | 6 |
| Public Health Agency of Canada | 1 | 1 |
| Royal Canadian Mounted Police | 1 | 4 |
| Foreign Affairs, Trade and Development | 1 | 10 |
| Total | 5 | 21 |
Completed requests were classified as follows:
| Disposition of Requests | Requests Completed by Percentage |
|---|---|
| Request abandoned | 32% |
| Disclosed in part | 31% |
| No records exist | 31% |
| All disclosed | 6% |
A large percentage of Privacy Act requests made to Health Canada are abandoned, mainly due to the requester’s confusion surrounding the mandate of the Department and the information that it holds. Most of these “abandoned” requests concerned personal medical records that fall under provincial jurisdiction and are not held by Health Canada. Requesters are advised of these details.
Sections 18 through 28 of the Act set out the exemptions intended to protect information pertaining to a particular public or private interest. Section 26 “personal information of other individuals” accounted for 74% of the all exemptions invoked in 2018–2019.
| Exemptions | Number of Times Applied |
|---|---|
| Section 26 – Information about another individual | 65 |
| Section 25 – Safety of individuals | 10 |
| Section 27 – Solicitor-client privilege | 9 |
| Section 21 – International affairs and defence | 3 |
| Section 22 – Law enforcement and investigation | 1 |
The Act does not apply to personal information that is available to the public (section 69), nor does it apply to confidences of the Queen's Privy Council (section 70), with some exceptions. Requests containing proposed exclusions under section 70 require consultation with the Department of Justice, and potentially the Privy Council Office. In 2018–2019, Health Canada did not exclude any information under either section 69 or 70.
Health Canada was able to respond within 30 days or less in 69% of the completed requests. Of the remaining requests, 16% were completed in 31 to 60 days, 6% in 61 to 120 days, and 9% in 121 days or more.
Legal extensions were invoked in 22 cases (10%) of the total 215 requests completed.
There were no requests for translation of records responsive to Privacy Act requests in 2018–2019.
Of the requests that were fully or partially disclosed, 35 were released in paper format, while the remaining 44 were released as electronic copies. Electronic copies are available through CD or E-Post. E-Post is a service offered by Canada Post that provides an accessible platform to share information. E-Post was introduced in fiscal year 2018–2019 to provide requesters with easier and more timely access to information
There were no requests for the correction or the notation of personal information during this fiscal year.
Health Canada spent a total of $1,891,941 responding to requests related to the Act. Of this total, salaries and overtime costs represent $1,242,442 and administration costs accounted for $649,499; most of the administration costs were used to retain temporary help to support the processing of requests.
Health Canada continued to offer privacy awareness training through the Employee Orientation sessions. General Privacy awareness training during these sessions was provided to 386 employees during the 2018–19 fiscal year. These sessions provided participants with a high level understanding of the Privacy Act, including general obligations regarding the collection, use, disclosure, retention and disposal of personal information, the “need to know” principle, and requirements relating to the processing of access to information requests.
During the reporting year, several targeted training sessions were offered in an effort to provide tailored privacy awareness. This included sessions for human resources functional specialists, the Office of Medical Access Intake Group, as well as privacy and ethics training for the Data and Innovation Division. Total participation in these focused training sessions was 76 participants. In addition, an e-learning tool: “Privacy Basics and Privacy Impact Assessments” continued to be used in 2018–2019. Approximately 550 Health Canada employees completed this training.
In addition, Health Canada continues to increase privacy awareness among employees by participating in several departmental events. These included hosting a kiosk at the National Public Service Week, hosting a privacy awareness session at the Young Professional’s Network, the Take Your Kids to Work event and partnering with the Security Management Division for an event during the Security Awareness Week. Participants in these sessions totaled 169.
In an effort to continue to enhance awareness, privacy-related issues were raised by the Health Canada Corporate Services Branch Assistant Deputy Minister ( ADM ) at various large-scale departmental events. This included updates and highlights at branch-wide town halls and all-staff meetings to raise privacy awareness.
PMD also began laying the foundation to promote greater integration and partnerships with other areas that have complementary mandates, such as Information Management, IT Security and the Security Management Division. This work is expected to result in more streamlined processes and assist in further raising departmental privacy awareness. These efforts are expected to continue and evolve over the course of the 2019–2020 fiscal year.
In fiscal year 2018–2019, the Privacy Management Division updated the Privacy Management Framework of Health Canada/Public Health Agency of Canada. The revised framework includes a robust governance model that will further strengthen privacy considerations across the department. PMD also developed departmental guidelines on privacy requirements for the collection of human biological material.
Health Information Privacy Group
Health Canada continues to participate as a member of the Canada Health Infoway's Federal-Provincial-Territorial Health Information Privacy Working Group, focused on privacy issues related to the development of digital health services in Canada. In 2018–2019, Health Canada participated in two in-person meetings.
In 2018–2019, TBS issued a revised Directive on Personal Information Requests and Correction of Personal Information that impacts how Privacy Act requests are processed. The ATIP Division introduced three principal changes to address these requirements:
Six complaints were received by Health Canada under Section 31 related to the handling of personal information under the Privacy Act. Two Section 33 notices were sent by the Office of the Privacy Commissioner (OPC) to the Department; these notices provide the opportunity to make formal representations relating to active investigations. Thirteen Letters of Finding under Section 35 relating to complaints were received from the OPC.
In 2018–2019, the OPC conducted 13 investigations into complaints relating to the processing of requests under the Privacy Act. In five cases, the OPC found the complaint to be valid.
Health Canada received two complaints from the OPC related to the way the department managed personal information. Representations were provided for both complaints, however, findings were not issued in fiscal year 2018–2019 but are expected to be reported in next year’s Annual Report. One Letter of Findings on a complaint related to the department’s management of personal information was received from the OPC. The complaint was determined to be not well-founded.
The Department reviews the outcomes of all OPC investigations, and where appropriate, incorporates lessons learned into business processes.
There were no applications or appeals submitted to the Federal Court or the Federal Court of Appeal during fiscal year 2018–2019.
There were no recommendations raised by other Agents of Parliament during fiscal year 2018–2019.
There were no privacy audits concluded during fiscal year 2018–2019 for Health Canada.
The ATIP Division has undertaken the production of weekly, monthly and quarterly reporting to senior management in order to monitor performance within Health Canada. Similarly, PMD produces quarterly reports on privacy breaches and privacy impact assessments. PMD supports compliance by periodically reviewing its privacy policies, procedures and practices.
During the 2018–2019 fiscal year, Health Canada reported no material privacy breaches.
Two Privacy Impact Assessments ( PIA ) were completed during the 2018–2019 fiscal year. Below are
brief descriptions of the PIA s. For additional information please contact: hc.privacy-vie.privee.sc@canada.ca.
A PIA was conducted for this program to examine the privacy-related risks associated with the Controlled Substances Directorate’s monitoring activities for controlled substance and precursors, as required by regulation; specifically, for monitoring reported losses and thefts of controlled substances and precursors.
This PIA examined the privacy risks of the Tobacco Control Directorate’s online inspection activities of tobacco and vaping products.
There was one disclosure made to an investigative body pursuant to paragraph 8(2)(e) of the Privacy Act.
There was one 8(2)(m) disclosure under the Act to another federal institution and one section 8(5) written notification was provided to the OPC prior to disclosure.
Delegation Order
Access to Information Act and Privacy Act
I, the Minister of Health, pursuant to section 95 of the Access to Information Act and section 73 of the Privacy Act, hereby delegate the persons holding the positions set out in the Delegation of Authority Schedule attached hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Minister as head of Health Canada, under the provisions of the Acts and related regulations set out in the schedule opposite each position. This delegation supersedes all previous delegation orders.
The Honourable Patty Hajdu
Minister of Health
January 22, 2020
| Provisions | Description | DM | ADM CSB | DG PIMSD | Dir ATIP Ops | Deputy Dir ATIP Ops |
|---|---|---|---|---|---|---|
| All Provisions | All powers, duties and functions under the Access to Information Act, R.S.C. 1985, c. A-1 (prior to and following June 21, 2019) and related regulations (prior to and following June 21, 2019) | Full authority | ||||
No - No Delegation
| Provisions | Description | DM | ADM CSB | DG PIMSD | Dir ATIP Ops | Deputy Dir ATIP Ops |
|---|---|---|---|---|---|---|
| All Provisions | All powers, duties and functions under the Act and Regulations | Full authority | ||||
