2022/23 Annual Report to Parliament on the Administration of the Privacy Act

On this page

• List of acronyms and abbreviations
• List of charts
• List of tables
• Introduction
• Organizational structure
• Delegation Order
• Performance for 2022/23
• Training and awareness
• Policies, guidelines and procedures
• Initiatives and projects to improve Access to Information
• Summary of key issues and actions taken on complaints or audits
• Material privacy breaches
• Privacy impact assessments
• Public interest disclosures
• Monitoring compliance
• Appendix A - Delegation Order
• Appendix B - Statistical report on the Privacy Act
• Appendix C - Supplemental statistical report on the Access to Information Act

List of acronyms and abbreviations

ATIP

Access to Information and Privacy

GBA Plus

Gender-based Analysis Plus

IM/IT

information management / information technology

MOU

memorandum of understanding

RCMP

Royal Canadian Mounted Police

List of charts

• Chart 1: Workload
• Chart 2: Completion rate of closed requests
• Chart 3: Disposition of completed requests
• Chart 4: All consultations received and completed
• Chart 5: Active outstanding requests from previous reporting periods
• Chart 6: Number of open complaints

List of tables

• Table 1: Schedule
• Table 2: Number of requests received
• Table 3: Channels of requests
• Table 4: Number of informal requests
• Table 5: Channels of informal requests
• Table 6: Completion time of informal requests
• Table 7: Pages released informally
• Table 8: Disposition and completion time
• Table 9: Exemptions
• Table 10: Exclusions
• Table 11: Format of information released
• Table 12: Relevant pages processed and disclosed for paper and e-record formats
• Table 13: Relevant pages processed by request disposition for paper and e-record formats by size of requests
• Table 14: Relevant minutes processed and disclosed for audio formats
• Table 15: Relevant minutes processed per request disposition for audio formats by size of requests
• Table 16: Relevant minutes processed and disclosed for video formats
• Table 17: Relevant minutes processed per request disposition for video formats by size of requests
• Table 18: Other complexities
• Table 19: Number of requests closed within legislated timelines
• Table 20: Reasons for not meeting legislated timelines
• Table 21: Requests closed beyond legislated timelines (including any extension taken)
• Table 22: Requests for translation
• Table 23: Disclosures under Subsections 8(2) and 8(5)
• Table 24: Requests for correction of personal information and notations
• Table 25: Reasons for extensions
• Table 26: Length of extensions
• Table 27: Consultations received from other Government of Canada institutions and other organizations
• Table 28: Recommendations and completion time for consultations received from other Government of Canada institutions
• Table 29: Recommendations and completion time for consultations received from other organizations outside the Government of Canada
• Table 30: Requests with Legal Services
• Table 31: Requests with Privy Council Office
• Table 32: Complaints and investigations notices received
• Table 33: Privacy impact assessments
• Table 34: Institution-specific and central personal information banks
• Table 35: Material privacy breaches reported
• Table 36: Non-material privacy breaches
• Table 37: Allocated costs
• Table 38: Human resources
• Table 39: Enter the number of weeks your institution was able to receive ATIP requests through the different channels
• Table 40: Enter the number of weeks your institution was able to process paper records in different levels
• Table 41: Enter the number of weeks your institution was able to process electronic records in different classification levels
• Table 42: Enter the number of open requests that are outstanding from previous reporting periods
• Table 43: Enter the number of open complaints with the Information Commissioner of Canada that are outstanding from previous reporting periods
• Table 44: Enter the number of open requests that are outstanding from previous reporting periods
• Table 45: Enter the number of open complaints with the Privacy Commissioner of Canada that are outstanding from previous reporting periods
• Table 46: Has your institution begun a new collection or a new consistent use of the Social Insurance Number in 2022/23?
• Table 47: How many requests were received from confirmed foreign nationals outside of Canada in 2022/23?

Introduction

The 2022/23 fiscal year marks the Royal Canadian Mounted Police (RCMP)’s second year of its five-year modernization plan for its Access to Information and Privacy program. The RCMP is pleased to report some significant improvements to its performance and program overall, and is proud of its ongoing collaboration with our employees across Canada, as well as our network of partnerships with other Government of Canada departments. These improvements are also a testament to the hard work and dedication of the Branch’s employees.

The biggest change to the Branch with the most impact, was the creation of three streams: Operations, Access and Privacy. By dividing the work and allowing employees in each stream to focus on their respective sections/priorities, the Branch as a whole has made important strides in compliance rates and to attract, hire and retain more staff. Employees within each stream can also better tailor their training plans and career goals to match their stream which will contribute to retention – an important goal for the Branch.

Ensuring Canadians have timely access to information so that they understand how and why the RCMP makes decisions and the challenges we face, is key to strengthening their trust in our organization. The RCMP takes these responsibilities seriously, and is committed to meeting the expectations of Canadians while protecting the integrity of the investigations undertaken on their behalf. Canadians are encouraged to monitor our work through the public website.

The RCMP is pleased to outline in this annual report details of the manner in which it discharged its responsibilities in relation to the Privacy Act during the reporting period. The report is prepared and tabled in Parliament in accordance with section 72 of the Privacy Act.

Organizational structure

Delegation Order

The Departmental ATIP Coordinator has full authority to administer the legislation. A copy of the signed Delegation Order is included in Appendix A. Of note, due to the reorganization of the Branch (see Section 6), this delegation order is being updated to reflect the new operational structure.

Performance for 2022/23

This section provides on overview of the RCMP’s performance with respect to records requested under the Privacy Act for the 2022/23 reporting year. The completed statistical report is found in Appendix B and the supplemental statistical report is found in Appendix C.

The ATIP Branch remained operational during the 2022/23 fiscal year reporting period; there were no significant impacts on ATIP performance attributable to COVID-19. It continued to work closely with its partners and stakeholders in finding solutions and reviewing processes to ensure that it responded to Canadians’ requests in a satisfactory and timely manner. However, it continued to face challenges that resulted in response delays to requests submitted. Despite its legislative responsibilities, certain realities prevented the RCMP from responding on time.

During the reporting period, some delays were attributable to the following:

• operational requirements that called for RCMP members and employees to be redeployed for instance: natural disasters like wildfires and flooding, significant investigations (Mass Casualty Commission, Freedom Convoy activities, police assistance for pipeline projects), and major events such as the papal visit, to name a few
• the RCMP still relies heavily on paper-based processes, with records that have not been digitized
• the extensive search required (more than 750 locations throughout Canada)
• the lack of experienced ATIP analysts

The RCMP recognizes the importance of complying with legislated timelines. That is why it continues to overhaul its program and address these issues by:

• devoting resources to improve the timeliness of responses
• modernizing/streamlining policies and procedures within the program to enhance operational efficiency
• expanding training and awareness campaigns for RCMP personnel to ensure they understand the obligation to respond within legislated timeframes

Training and awareness

Continuous learning is a priority for the RCMP and the ATIP Branch is no exception. ATIP Branch staff are encouraged to seek out relevant courses and other learning opportunities as a means to enhance their knowledge and to improve their skills.

For the 2022/23 reporting year, the ATIP Branch held regular information-sharing sessions where staff discussed files and shared best practices. As new technological tools were introduced to support remote collaboration during the pandemic, the RCMP was able to leverage these tools (particularly videoconferencing) to provide a number of training sessions to employees. In-house training and orientation were provided to new ATIP operational support staff and virtual training was provided to Office of the Information Commissioner investigators on the structure and mandate of the RCMP, the information management team in B Division (Newfoundland and Labrador), the Province of British Columbia’s Information Access Operations Council, and the RCMP Human Source Unit, among others. In total, 11 training sessions were given to 829 employees.

As part of the modernization efforts, the ATIP Branch began the first of a multi-year plan to visit every division in person. These visits will provide an opportunity for the ATIP Branch, along with its partners to enhance communications by meeting directly with record holders to discuss concerns, meet with divisional management to reiterate the importance of compliance with the Access to Information Act and the Privacy Act (including getting privacy right), and to offer training sessions to divisional personnel. As part of the divisional visits, the Privacy stream worked with counterparts in Departmental Security and the National Technology Onboarding Program to carry out presentations and awareness sessions, focusing specifically on privacy breaches, data security and the onboarding of new technology. In this reporting period, presentations were organized with National Division (Ottawa), O Division (Ontario) and E Division (British Columbia), reaching over 1,000 employees at all levels, including RCMP senior leaders in the divisions. These visits also served to strengthen the bonds between the ATIP Branch and our divisional Liaison Officers, the benefits of which can be seen on a daily basis. Plans are underway to continue these visits in the coming reporting period.

The ATIP Privacy Policy Unit continued to provide training and presentations to internal partners and offices of primary interest, specifically in relation to privacy breaches and conducting privacy impact assessments. Two presentations were provided on privacy breaches involving 32 participants, and three presentations were provided on conducting privacy impact assessments involving 22 participants. The unit also made efforts to emphasize the importance of privacy to RCMP senior leaders throughout the 2022/23 fiscal year.

For the 2022 Privacy Awareness Week, the Privacy Policy Unit conducted two organization-wide events including a trivia challenge to bolster privacy awareness, and a speaking event on privacy breaches in conjunction with the Office of the Privacy Commissioner. Both events were very successful drawing in 102 participants and 287 participants, respectively.

In an effort to encourage growth and retention in the ATIP Branch, a developmental program was approved and adopted. This program is designed to build new ATIP analysts from the ground up. In such a highly competitive field, it is important to offer employees opportunities to grow and further develop their skills. The professional development program will bring employees from a PM-01 level to a PM-04 as senior analysts.

During the previous reporting period, the ATIP Branch, in conjunction with the RCMP's Learning and Development Unit, created the Access to Information and Privacy Fundamentals online course available to all RCMP employees. In addition to increasing their knowledge of the Access to Information Act and the Privacy Act, this course also provides employees with a better understanding of their responsibilities when responding to information requests and best practices when managing personal information. In 2022/23, over 1,200 new RCMP employees successfully completed the course.

ATIP divisional Liaison Officers also provided presentation sessions to their record holders (Offices of Primary Interest). The sessions included an overview of ATIP modernization, employee’s roles and responsibilities and a list of resources. Discussions during the presentation also quelled misunderstandings regarding the process, while reinforcing proper information management. Specifically, J Division (New Brunswick) provided 16 sessions with attendance of almost 150 employees.

Policies, guidelines and procedures

Throughout this reporting period, the ATIP Branch continued to modernize and update internal policies and procedures to ensure alignment with current reporting standards. These changes will continue to be developed and instituted in the 2023/24 reporting period.

During 2022/23, the ATIP Branch accomplished the following:

• Enhanced internal processes for facilitating the transfer of files within the RCMP, including the creation of national shared drives for classified information
• Updated the Access to Information, Privacy and Operations teams’ standard operating procedures, which was part of the ATIP Branch’s efforts to formalize internal processes
• Modified guidelines to address its on-time and backlog files, enabling processing efficiencies
• Worked with business lines and divisional Liaison Officers to develop guidelines, standards and awareness communiques to further facilitate RCMP ATIP modernization, and implemented new regular by-weekly meetings to resolve challenges as quickly as possible
• Continued to lead the interdepartmental working group for the development of business continuity plans specifically for ATIP programs, which led to greater information sharing among the participating departments
• Reviewed employee work arrangements and implemented a hybrid work model for its employees, allowing more flexibility in turns of work-life balance
• Weekly meetings held with ATIP Branch, RCMP Communications, and Parliamentary Affairs ensured the organization was able to properly brief the Commissioner and Minister’s office should questions arise. The meetings also provided insight to the ATIP Branch of topics that generated media interest and would result in requests
• Successfully piloted the temporary hiring of employees from across the country who can work remotely, to support the divisions
• Onboarding remote employees as part of ATIP Branch modernization to increase the pool of ATIP experienced employees outside of the National Capital Region
• Development of new operational policies for unique types of materials; as an example, a new directive has been approved by ATIP Branch and the Human Source Unit on how to process request containing source information

Our divisional Liaison Officers are also working to establish processes and workflows. Specifically, E Division (British Columbia) is building their team, creating shared proxy accounts for ATIP requests for over 40 units/detachments, leveraging collaboration tools for improved communications and ensuring consistent and streamlined processes while building a stronger governance framework. As well, F Division (Saskatchewan) assisted with the development of privacy notice statements and questionnaires and reviewing MOUs and coaching junior staff.

Additionally, the Privacy Policy Unit completed the following:

• Continued work on development of standard operating procedures, updated policies and its privacy framework, as well as efforts towards restructuring RCMP personal information banks
• Completed a review of its policy and guidance documents on privacy impact assessments; the new guidance documents include a detailed privacy impact assessment handbook, a high-level privacy impact assessment guide, and an updated interim privacy impact assessment template
• Developed internal standard operating procedures on Privacy Impact Assessment Questionnaires in accordance with Treasury Board guidance and directives on privacy
• Updated internal standard operating procedures relating to privacy breaches and complaints received in relation to Section 4-8 of the Privacy Act. In addition, to ensure the organization is provided with timely and useful advice, the Privacy Policy Unit developed an internal standard operating procedure for responding to inquiries

Initiatives and projects to improve Access to Information

Ongoing work enhancements

The RCMP continued to engage PricewaterhouseCooper (PwC) to assist with its modernization efforts. During the reporting period, new approaches designed to support culture and business process changes (for example, introduction to new skills and tools for day-to-day work) have been implemented. Branch sustainability plans were also created and are monitored monthly and updated quarterly. A change management plan was also developed that identified new opportunities to promote and push change throughout the RCMP. Stakeholders also provided positive feedback on the modernization efforts.

Restructuring and hiring blitz

As previously noted, the ATIP Branch has begun implementing a significant restructure and reorganization to ensure that it is bringing the necessary resources and leadership to meet its obligations under the Access to Information Act and the Privacy Act. The new structure separates the ATIP Branch into three streams: Access to Information (responsible for meeting Access to Information Act obligations); Privacy (responsible for meeting Privacy Act obligations); and, Operational Supports (responsible for providing critical support services for the entire Branch, such as intake, systems maintenance and data reporting and analysis). Each stream is led by a director, with the Branch now reporting to a Director General. These changes are bringing new personnel into the Branch with the ultimate objective of almost doubling its size over the next four years. As part of its continued modernization efforts, the Branch is looking for people from a variety of places in order to meet its staffing needs. Staffing efforts in all areas, including indigenous recruiting, has resulted in growth from approximately 65 employees to almost 90 by the end of the reporting period. The Branch currently receives funding to staff about 118 positions with a projected organizational chart of 137 staff. For the 2023/24 fiscal year, it will focus on staffing all funded positions.

Focusing on training

As part of broader modernization efforts, the ATIP Branch continued to promote the online ATIP Fundamentals training course to personnel, which resulted in a positive enrollment rate. The ATIP Branch also provided presentations to RCMP employees in four different divisions and divisions provided internal training to their Offices of Primary Interest. Additional efforts continue on the development of new training and course offerings for ATIP Branch personnel and the broader organization that will be in place for the next reporting period. In fact, expanding training delivery forms a key part of the Branch’s human resources strategy for ATIP modernization, succession planning, and employee retention.

Sharing best practices

ATIP modernization is underway across the Government of Canada. In order to ensure that the RCMP continues to benefit from the lessons learned and work underway by its partners, and that partners were aware of work underway at the RCMP, the RCMP remains the lead of an interdepartmental working group to exchange best practices and identify areas for collaboration. Some of the topics discussed have included onboarding of new employees, key performance indicators and improved streamlining practices.

Additional efforts include the following:

• As part of the RCMP’s response to major events such as the Freedom Convoy in Ottawa and the police assistance for pipeline projects in British Columbia, the ATIP Branch assigned key analysts who work directly with the record holders to retrieve relevant records. This provided a consistent and quick response due to their complete and unique knowledge of the records.
• The ATIP Branch was involved in the implementation of the Mass Casualty Commission’s recommendations following the events in Portapique, Nova Scotia. Advice and guidance were given to ensure the RCMP’s response was more open and transparent from the onset.
• Technology is fundamental to ATIP’s ability to meet its obligations under the Acts. The Branch is exploring such options including new case management software, the use of automation, and cloud computing to find efficiencies to improve our response times.
• Money and technology were provided to divisions and Liaison Officers to enhance their ATIP capabilities with the goal of creating divisional ATIP bureaus
• The ATIP Branch regularly works with the RCMP’s Audit and Evaluation unit to conduct informal reviews of audits/reports prior to their publication
• Following a Ministerial Directive, the ATIP Branch continues to support the RCMP’s Management Advisory Board by conducting informal reviews prior to the publication of their recommendations which supports internal reform while remaining transparent with the public

During fiscal year 2022/23 the Privacy Policy Unit continued to strengthen its relationship with the newly conceived National Technology Onboarding Program. As part of this relationship building, both units worked together to develop a RASCI Matrix (Responsible, Accountable, Supportive, Consulted, Informed), which clarifies and defines roles and responsibilities when working with RCMP offices of primary interest.

In addition to National Technology Onboarding Program, the Privacy Policy Unit strengthened its relationship with other key internal stakeholders, such as the IM/IT section, GBA Plus Centre of Expertise and the MOU Policy Centre. The Privacy Policy Unit now meets regularly with these partners to share information and expertise, and to ensure there are no gaps relating to privacy for the organization.

Nearing the end of this reporting period, the RCMP joined the Treasury Board of Canada Secretariat ATIP Online Management Tools portal. This portal allows applicants to submit their requests under both the Access to Information Act and the Privacy Act online, directly to the institution, upload any required supporting documentation, and even receive their release packages online. This move towards digital requests and responses has improved the service ATIP offices have been able to provide to our clients.

As part of the RCMP Vison150 and the ATIP Office's own modernization efforts, there is an extensive privacy and security awareness training strategy under development; including but not limited to:

• development and sharing of breach and privacy impact assessment management tools
• executive leadership deck has been created and is now in circulation
• increase of privacy resources in the Privacy Policy Unit from 3 to 11 since January 2022 with a planned increase to a total of 14 resources to support the RCMP and all things privacy policy related; dedicated Client engagement and outreach team, as well as a Privacy compliance team; all with an effort to increase privacy compliance, education, awareness and support to the RCMP

Summary of key issues and actions taken on complaints or audits

Material privacy breaches

As Canada’s national police force, the RCMP is trusted to handle and protect the personal information of Canadians with professionalism and integrity, a job it takes very seriously. To safeguard the personal information in its care, the RCMP has strict policies and procedures in place to prevent unauthorized access and disclosure across the organization, however even with these rigorous procedures in place, privacy breaches still occur, often, as a result of human error. With every privacy breach, the RCMP takes steps to improve its processes to ensure that similar incidents do not occur again.

When a privacy breach is detected, the RCMP Access to Information and Privacy Branch follows the Treasury Board of Canada Secretariat’s guidelines to determine the privacy risks and reports all breaches, deemed material, to the Office of the Privacy Commissioner and the Treasury Board of Canada Secretariat.

During fiscal year 2022/23, the Privacy Policy Unit received and reviewed 121 possible privacy breach reports of which eight were deemed material and reported to the Office of the Privacy Commissioner and Treasury Board of Canada Secretariat, 81 were deemed non-material, nine were determined to not be privacy breaches, two were transferred to the originating department for further investigation and 21 are ongoing.

Privacy impact assessments

During the reporting period, the RCMP completed three privacy impact assessments. Privacy impact assessments for the Independent Centre for Harassment Resolution, Babel X Platform, and Canadian Firearms Program Online Possession and Acquisition License Minimum Viable Product.

Three new privacy impact assessments were submitted to the ATIP Branch during the reporting period. In addition, three privacy impact assessments were carried forward from the fiscal year 2021/22. All six privacy impact assessments received an initial review by the Privacy Policy Unit . Additionally, the Privacy Policy Unit reviewed 69 privacy impact assessment questionnaires to determine the need for a privacy impact assessment, 10 Treasury Board Submissions, three Memoranda to Cabinet, two statements of work/requests for proposal to ensure privacy requirements are included in contracts, and 27 Memoranda of Understanding.

The ATIP Policy Unit engaged in two consultation sessions with the Office of the Privacy Commissioner. The first consultation session was regarding the Covert Access and Intercept Team and their work towards a program-level privacy impact assessment, which will cover the RCMP’s use of on-device investigative techniques. The ATIP Policy Unit continues to work with the Covert Access and Intercept Team on their privacy impact assessment, and expects that it will be submitted to the Office of the Privacy Commissioner by the summer 2023. The second consultation session with the Office of the Privacy Commissioner involved an MOU to share information with the Law Society of Ontario regarding alleged attorney misconduct found in the course of an investigation.

In addition to consultation meetings, the ATIP Policy Unit continues to meet with the Office of the Privacy Commissioner to provide updates on key files on a bi-monthly basis.

Public interest disclosures

During the 2022/23 fiscal year, 42 disclosures were made pursuant to paragraph 8(2)(m) of the Privacy Act. The majority of disclosures were related to the duty status of charged RCMP members and the release of dangerous offenders into communities across Canada. However, in two cases disclosures were made relating to exceptional circumstances. In those two cases, the Office of the Privacy Commissioner was notified in advance and in all other cases, the notifications were made after the fact.

Monitoring compliance

The ATIP Branch monitors compliance through weekly and monthly statistical reports, which include the compliance rate, the number of files completed on time and those that are delayed, as well as complaints both received and closed. New for this reporting period is the monthly and quarterly reporting of number of privacy impact assessments and material breaches received by the ATIP Office and subsequently submitted to the Office of the Privacy Commissioner. Performance Dashboards are also key tools to further identify trends and assist the ATIP Branch in strategically developing efficiencies. The Branch’s management team reviews the weekly and monthly reports to manage workload and to determine any upcoming issues where processes could be improved. The reports and dashboards are provided to the RCMP’s Strategic Policy and External Relations Officer and the Commissioner in an effort to improve accountability.

The ATIP Branch continues work on bolstering its data reporting function by onboarding new technology and processes. This new technology will enable the ATIP Branch to be more strategic and transparent, by automatically capturing pertinent data to assist with its planning and public reporting as well as to identify areas where efficiencies may be found.

In addition, the Privacy Policy Unit helps ensure appropriate privacy protections are included in contracts, agreements and arrangement for the organization when they involve the collection, use or disclosure of personal information. The unit works closely with the MOU Policy Centre, which is responsible for supporting and monitoring these documents, to ensure privacy is taken into consideration in the development of these products. In addition, the unit has taken the new obligations set out in section 4.2.26 of the Directive on Privacy Practices seriously, and has begun to develop processes for ensuring compliance with the new reporting requirements.

Appendix A – Delegation Order

Appendix B - Statistical Report on the Privacy Act

Name of institution

Royal Canadian Mounted Police

Reporting period

2022-04-01 to 2023-03-31

Appendix C - Supplemental Statistical Report on the Access to Information Act and the Privacy Act

Name of institution

Royal Canadian Mounted Police

Reporting period

2022-04-01 to 2023-03-31