2024-2025 Annual Report to Parliament on the Administration of the Privacy Act

Royal Canadian Mounted Police

As a federal, provincial, territorial and municipal policing body, the RCMP provides federal policing services to all Canadians and policing services under contract to the three territories, eight provinces, and more than 150 communities delivered through more than 700 detachments across Canada, 600 Indigenous communities and three international airports.

The RCMP's mandate is multifaceted and includes preventing and investigating crime; maintaining peace and order; enforcing laws; contributing to national security; ensuring the safety of state officials, visiting dignitaries and foreign missions; and providing vital operational support services to other police and law enforcement agencies within Canada and abroad.

A Commissioner leads the RCMP and is supported by a Senior Executive Committee (SEC) made up of regular members, civilian members and public servants. The role of SEC is to develop, promote and communicate strategic priorities, strategic objectives, management strategies and performance management for the purpose of direction and accountability.

The organization is subdivided into 15 divisions (10 provinces, three territories, Depot Division and National Headquarters in Ottawa), each of which is under the direction of a Commanding Officer or Director General.

National Headquarters includes 10 business lines and is structured as follows: Federal Policing, Contract and Indigenous Policing, Specialized Policing Services, Corporate Management and Comptrollership, Human Resources, Internal Audit and Evaluation, Professional Responsibility Sector, Strategic Policy and External Relations, Reform Accountability and Culture, and Legal Services.

Access to Information and Privacy (ATIP) Branch

The RCMP established the ATIP Branch in 1983, as the central point of contact for all matters arising from both the Access to Information Act (ATIA) and the Privacy Act (PA). The ATIP Branch reports through the Chief Digital Officer to the Deputy Commissioner of Specialized Policing Services. The IM/IT Branch was renamed the Digital Program in December 2024. The new Digital Program is responsible for leading the technological transformation of the RCMP, along with Analytics, Data and Information Management and the ATIP Branch. While this is not a common structure within government, it unites Information Management (IM) and Information Technology (IT) with ATIP further enabling the modernization of the ATIP program. These benefits include a more high-profile role for the Branch in areas such as digital records management, open government, and the declassification of historical records.

The ATIP Branch's Director General acts on behalf of the head of the institution as the Departmental Access to Information and Privacy Coordinator. The ATIP Coordinator ensures compliance with both the spirit and the intent of the PA, as well as all associated regulations, policies and guidelines. The Director General position is also tasked with leading the program's broad modernization efforts. The ATIP Branch is made up of 122 employees and 11 consultants who work on requests under both the ATIA and the PA.

Compliance

In alignment with the Treasury Board Secretariat's performance target of closing 90% of personal information requests within legislated timelines, the RCMP demonstrated notable progress in improving compliance. In the 2024–2025 fiscal year, the Branch achieved a compliance rate of 71% for requests closed within the legislated time frames under the Act—an increase from 61% in the previous fiscal year. This upward trend reflects ongoing efforts to enhance the timeliness and efficiency of our access to information and privacy processes. The increase is due, in part, to modifications in processes within the Branch resulting in efficiencies, increased efforts in human resources (staffing, training, retention) and the utilization of contractors to complete complex late files to address legislative compliance.

As demonstrated in Table 1 below, significant efforts were undertaken to conclude many backlog requests resulting in more files closed and more pages processed than the previous reporting period. Of note, 1,083 requests were concluded as abandoned when requesters failed to provide sufficient information at the outset to process their request. These requests would have positively influenced the compliance rate.

Requests received and closed

The RCMP received a total of 9,232 new requests under the Privacy Act in 2024–2025. In addition, there were 5,987 requests outstanding from the previous reporting periods for a total of 15,219 requests. Of these, 10,424 requests were completed and 4,795 carried over to the 2025–2026 fiscal year.

Privacy requests cover the personal information of requesters in a variety of records and mediums (e.g. audio/video), including information on police operational files, such as motor vehicle collisions and employment files.

There has again been an increase in the number of requests received compared to the previous reporting period. The number of requests received increased by 18% compared to the previous fiscal year (7,808 requests received) and increased by 94% compared to the 2022–2023 fiscal year (4,741 requests received). The increase in the number of privacy requests received is a direct result of the Branch's efforts to educate requesters, including adding guidance to the TBS portal advising requesters to use the PA to request their own personal information. This has benefited requesters as privacy requests can be made free of charge, provides them with an expanded right of access, and grants requesters the right to correction, none of which exists under the ATIA. The increase here correlates to a decrease in requests made under the ATIA.

Completion time and extensions

The ATIP Branch completed 4,289 (41%) requests in 30 days or less. During the reporting period, 2,977 (28.5%) requests were completed within 31-60 days, 761 (7.3%) were completed in 61-120 days, and 2,387 (22.8%) were completed in more than 121 days.

Section 15 of the Privacy Act allows institutions to extend the statutory time limits to respond to a request beyond 30 days.

For the requests closed during the 2024–2025 reporting period, the RCMP sought a total of 7,038 extensions under section 15(a)(i), which pertains to unreasonable interference with operations.

No extensions under section 15(a)(ii) were taken for consultations.

Disposition of Completed Requests

Of the 10,424 requests completed in the 2024–2025 fiscal year, the dispositions of completed requests were as follows:

Consultations for other institutions

During the current reporting period, the RCMP completed 116 consultations, totalling 4,845 pages reviewed. Of the 116 completed consultations, 46 were received from other Government of Canada institutions and 70 were received from other organizations. This is a marked decrease from the previous reporting period where RCMP reviewed 105 requests and 12,156 pages. The RCMP continues to put an equal focus on consultations as a service to the ATIP community and in line with the expectations of the Privacy Commissioner.

Active outstanding requests from previous reporting periods

At the conclusion of the 2024–2025 fiscal year, a total of 4,795 requests were outstanding. Of those outstanding, 17% were carried over within legislated timelines and 83% were carried over beyond legislated timelines. The significant work done to eliminate the backlog of requests can be seen at Table 6 and in the numbers below. The legacy backlog has been reduced by approximately 30%, from 6.4 million pages to 4.6 million pages over the reporting period. While there is still a backlog of requests to process, they are much more recent, and this demonstrates the efforts made to improve the service the RCMP is providing to the public. The fiscal years where the carried over requests were received in are as follows:

Active outstanding complaints from previous reporting period

At the conclusion of the reporting period, a total of 170 complaints were outstanding. The fiscal years where the outstanding complaints were received are as follows:

Policies, guidelines and procedures

Throughout this reporting period, the ATIP Branch continued to modernize and update internal policies and procedures to ensure alignment with current reporting standards. These changes will continue to be developed and instituted in the 2025–2026 reporting period.

Complaints and investigations

During this reporting period, the RCMP continued to work collaboratively with the OPC to address com¬plaints made under sections 4 through 8 of the Privacy Act related to the RCMP's collection, correction, retention, use, disclosure and disposal of personal information. Some of the key highlights of those complaints are below:

Collection and use of open-source information from the internet

Open-source information (OSI) refers to any information gathered or retrieved from the internet, the deep or dark web, and, in certain instances, commercially acquired information. In accordance with its mandate, the RCMP collects open-source information pertinent to predicated investigations to identify issues and relevant facts, and to develop and advise RCMP partners on security and safety matters. The PIA looked at open-source information collection in an operational context, excluding administrative contexts and security screening purposes. In order to ensure that the RCMP's collection and use of OSI complies with the Privacy Act, the Federal Policing Open-Source Program developed a set of policy instruments to enable a consistent operating framework for all open-source information practitioners. The program also oversees the integration of third-party tools that facilitate the conduct of this activity, in collaboration with the National Technology Onboarding Program. Based on this assessment, privacy impacts associated with the collection, use, disclosure and retention of open-source information from the internet by the RCMP are expected to be moderate.

For the full summary: Collection and use of open source information from the Internet

Police transitions

The RCMP provides contract policing to 8 provinces and 3 territories, as well as 150 municipalities and First Nations communities under 20-year Police Service Agreements. In recent years, several municipal jurisdictions have indicated their intention to end their police service agreements with the Government of Canada and establish new municipal police services, such as Surrey (British Columbia) and Grande Prairie (Alberta). In other situations, there has been a change in the boundaries of policing jurisdiction. The PIA sought to ensure that the RCMP implements the necessary mitigating measures regarding the transfer of personal information during a transition of policing duties. In such situation, the RCMP will only hand over files of ongoing and relevant investigation files—which include personal information—to the other policing service. Specific details and requirements to ensure the safe handling of personal information are to be specified in a Memorandum of Understanding between the two police services.

For the full PIA summary: Police transition

Blue Force Tracking (BFT)

BFT provides incident commanders and members on duty with a map of the GPS location of each member to enhance officer safety. It was implemented to meet a key officer-safety recommendation from the MacNeil Report after the 2014 incident in Moncton, New Brunswick, which resulted in the death of three RCMP officers. BFT employs a geo-spatial infrastructure for situational awareness in a General Duty policing environment using applications called Android Team Awareness Kit (ATAK) and Windows Team Awareness Kit (WinTAK). The PIA assessed these applications finding that BFT would be considered a medium risk program. Through the implementation of administrative and technical safeguards, privacy risks are expected to be reduced to an acceptable level.

For the full summary: Blue Force Tracking (BFT)

MyCFP Enhancements, Release 1, Program Increment 1

The RCMP Canadian Firearms Program (CFP) is modernizing its service delivery to avert significant error rates, be synchronous with changes to legislation and meet client expectation of reliable and efficient service. The "MyCFP" portal enhancements provide new functionalities to the cloud-based solution Canadian Firearms Public Digital Services Solution: the submission of online applications for a Minor's Licence, for applications under the Aboriginal Peoples of Canada Adaptations Regulations (Firearms), and Fee and Photo Waivers. The scope of the PIA is restricted to changes in how the Canadian Firearms Program collects personal information related to these enhancements.

For the full summary: MyCFP Enhancements, Release 1, Program Increment 1

MyCFP Enhancements, Release 1, Program Increment 2

The RCMP Canadian Firearms Program (CFP) is modernizing its service delivery. The "MyCFP" portal enhancements provide new functionalities to the Canadian Firearms Public Digital Services Solution. This phase of updates will allow members of the public to use the portal to submit four additional types of applications that were previously paper only. A PIA was completed to ensure the RCMP meets its legal obligations under the Privacy Act, and to ensure that privacy risks are identified, assessed and mitigated related to the following new services available on the portal: application for a carrier licence (first application only), application for a firearms licence for businesses or a museum (first application only), shooting club or shooting range approval application (first application only), and shooting club membership submission.

For the full summary: MyCFP Enhancements, Release 1, Program Increment 2

National Child Exploitation Crime Centre

The RCMP National Child Exploitation Crime Centre (NCECC) is a national program within the Sensitive and Specialized Investigative Services Branch that is mandated to reduce the vulnerability of children to Internet-facilitated sexual exploitation under Canada's National Strategy for the Protection of Children from Sexual Exploitation on the Internet. As the lead RCMP Program, the NCECC is responsible for operationalizing the National Strategy's objectives by identifying victimized children; investigating and supporting criminal justice outcomes; developing and deploying innovative technologies; providing criminal intelligence support; and strengthening the capacity of municipal, territorial, provincial, federal, and international police agencies through research, training, technology, intelligence and investigative support.

The program-level PIA considers the personal information handling practices of the NCECC to ensure the RCMP meets its legal obligations under the Privacy Act, and to ensure that privacy risks are identified, assessed, and mitigated, including in the use of operational technologies. To increase transparency, the RCMP created a new personal information bank specific to NCECC activities. The bank documents NCECC’s matching activities, including face matching to quickly sort, group and categorize large amounts of similar data to expedite human review and evaluation.

For the full summary: National Child Exploitation Crime Centre

National Digital Forensics Program

The RCMP National Digital Forensics Program's mandate is to implement lawful technological techniques using Digital Forensics Access Tools to search and seize digital criminal activity data from lawfully seized electronic devices. Digital Forensics Access tools are tools or techniques utilized to access digital evidence, which may vary depending on the hardware, software and network configurations of the lawfully seized devices. Data is extracted under warrant or lawful authority and in compliance with the Canadian Charter of Rights and Freedoms. A PIA was completed to ensure that the RCMP’s use of Digital Forensics Access tools meets its legal obligations under the Privacy Act and to promote transparency with the public. The assessment found that the privacy impact associated with the use of these tools is expected to be low.

For the full summary: National Digital Forensics Program

Body Worn Cameras (BWC) and Digital Evidence Management System (DEMS)

In 2020, the Government of Canada announced funding for the implementation of a National BWC Program for the RCMP. As part of the program, the RCMP will deploy up to 15,000 BWCs to frontline officers. Once fully implemented, all RCMP officers interacting with the public will be equipped with a BWC while on duty. BWCs will be used in plain sight to capture audio/visual recordings of interactions and incidents between uniformed police officers and members of the public.

The purpose of the PIA was to ensure that the RCMP operates its BWCs in a privacy sensitive manner. The PIA reviewed the lifecycle of personal information collected through BWCs and an assessment of core features and functionality of the RCMP's BWC and DEMS where the videos will be stored. The RCMP addressed most privacy issues in the PIA process. Risk mitigation measures, implemented prior to the program's launch and monitored on an ongoing basis, are expected to reduce the program's overall privacy risk to a low or acceptable level.

For the full summary: Body Worn Camera (BWC) and Digital Evidence Management Service (DEMS)

Race-Based Data Collection Initiative Project

The collection, analysis and disclosure of disaggregated race-based data is a priority for the RCMP and the Government of Canada to address systemic racism. The RCMP will adopt a “phased approach” to collecting, analyzing and reporting perceived race-based data (a member’s perception of an individual’s race or Indigenous identity). Members of the public will not be asked to self-identify. Data extracted from a select number of locations will eventually be used to publicly report trends and develop action plans. As a first step, the RCMP initiated a pilot which was the subject of this PIA. In scope of the pilot and the PIA are the collection of perceived race-based data and perceived Indigenous identity in selected locations, data quality assessments to enable analytics of de-identified data and public reporting in relation to use of force, wellness checks and arrests.

For the full summary: Race-Based Data Collection Initiative project

Assault-Style Firearms Compensation Program Phase 1 - Business

The "Assault-Style Firearms (ASF) Compensation Program Phase 1 - Business" is a multi-institutional PIA led by Public Safety Canada and supported by its partners, the RCMP and Employment and Social Development Canada (ESDC)/Service Canada. This PIA aims to facilitate the self-declaration of Assault-Style Firearms owners; the collection, validation, and destruction of Assault-Style Firearms; and issuing compensation.

For the full summary: Assault-Style Firearms Compensation Program Phase 1 - Business

Privacy Impact Assessment questionnaires

During the reporting period, PMD reviewed 66 PIAQs, from all sectors of the organization (Federal Policing, Contract and Indigenous Policing, Specialized Policing Services, and Internal Services). Eighteen of the PIAQs reviewed were part of the National Technology Onboarding Program (NTOP) assessment process. As per RCMP policy, PMD is a key stakeholder of the NTOP assessment process. PMD participates in meetings with business lines and vendors and assesses whether the onboarding of the new technology requires a PIA or any other mitigating measures to ensure the RCMP’s compliance with the Privacy Act and TBS policies.

In accordance with the requirements of the Policy on Privacy Protection, the RCMP regularly notifies the OPC and TBS of emerging initiatives that may have an impact on the privacy of Canadians. During the reporting period, the RCMP submitted three notifications. PMD also continues to meet with the OPC and TBS to provide updates on key files on a regular basis.

Memoranda of Understanding/Information Sharing Agreements

During the reporting period, the PMD reviewed 58 Memoranda of Understanding/Information Sharing Agreements from all sectors of the organization (Federal Policing, Contract and Indigenous Policing, Specialized Policing Services, and Internal Services) ensuring they complied with TBS policy requirements for arrangements involving personal information.

Privacy notices

During fiscal year 2024–2025, PMD drafted 109 privacy notice statements for clients looking to either create new forms or update existing forms collecting personal information.

Engagements with the Office of the Privacy Commissioner

In addition to regular file updates, the RCMP engaged in five consultation sessions with the OPC. For example, the RCMP sought the OPC’s advice on the Race-Based Data Collection initiative, as well as on the privacy implications related to the transition of police jurisdiction prior to submitting the respective PIAs. The RCMP also met with the OPC on the following initiatives:

Time taken to process PA requests

The ATIP Branch monitors the time taken to process PA requests by retrieving statistics from the case management software on a daily, weekly, monthly and quarterly basis. These statistics provide information on the compliance rate, the number of files completed on time and those that are delayed, as well as complaints both received and closed. Performance dashboards are also key tools to further identify trends and assist the ATIP Branch in strategically developing efficiencies. The Branch’s management team reviews the weekly and monthly reports to manage workload and to determine any upcoming issues where processes could be improved. The reports and dashboards are provided to senior management in an effort to improve accountability.

The ATIP Branch continues to work on bolstering its data reporting function by onboarding new technology and processes. This new technology will enable the ATIP Branch to be more strategic and transparent by automatically capturing pertinent data to assist with its planning and public reporting, as well as to identify areas where efficiencies may be found.

Access to Information Act and Privacy Act delegation order

The Minister of Public Safety and Emergency Preparedness, pursuant to section 73 of the Access to Information Act and of the Privacy Act, hereby designates the persons holding the position set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers and functions of the Minister as the head of a government institution, that is, the Royal Canadian Mounted Police, under the section of the Act set out in the Schedule opposite each position. This designation replaces and nullifies all such designations previously signed and dated by the Minister.

Signed, at the City of Ottawa, this 4 day of December, 2015

The Honourable Ralph Goodale, P.C., M.P.
Minister of Public Safety and Emergency Preparedness