Annual Report to Parliament 2019-2020 on the Administration of the Privacy Act

Table of contents

• Introduction
• Organizational structure
  • RCMP
  • Access to Information and Privacy (ATIP) branch
• Delegation order
• Performance
  • Impact of COVID-19 and mitigation measures
  • Compliance
  • Requests received and closed
  • Number of requests processed with over 5,000 pages
  • Completion time and extensions
  • Disposition of completed requests
  • Consultations for other institutions
• Training and awareness
• Policies, guidelines, procedures and initiatives
• Summary of key issues and actions taken on complaints or audits
  • Complaints and investigations
  • Court action
  • ATIP program internal audit
• Monitoring compliance
• Material privacy breaches
• Privacy impact assesments
• Public interest disclosures
• Appendix A - Delegation order
• Appendix B - Statistical report on the Privacy Act
• Appendix C - Supplemental statistical report on the Privacy Act - Requests affected by COVID-19 measures

Introduction

The Royal Canadian Mounted Police (RCMP) is committed to providing Canadians with information in a timely manner. Canadians need us to be open and transparent, and be accountable for the work we do. We take our responsibilities under the Access to Information and Privacy Acts seriously, and will continue to communicate how we meet Canadians' expectations, while protecting the public and the integrity of the investigations we undertake on their behalf.

The Privacy Act extends to individuals, the right of access to information about themselves held by the government, subject to specific and limited exceptions. The Actalso protects individuals' privacy by preventing others from having access to their personal information and gives individuals substantial control over its collection, retention, use and disclosure.

The RCMP's annual report for 2019-2020 details the manner in which it discharged its responsibilities in relation to the Act, during the reporting period. The report is prepared and tabled in Parliament in accordance with section 72(1) of the Privacy Act.

During the past two years, RCMP Commissioner Brenda Lucki has worked diligently with employees, partners and stakeholders, to develop a plan to modernize the RCMP approaches its 150th anniversary in 2023 and beyond.

The plan is making the RCMP a modern, healthy and effective organization: putting people first to achieve policing excellence and ultimately, a safer Canada. Our work won't stop in 2023 – we know that we need to continually evolve to keep pace with the policing environment and what Canadians need and expect from the RCMP.

The RCMP's framework for modernizing its police service sets out objectives and projects under four crucial pillars: our people, our culture, our stewardship and our police services.

As part of these modernization projects, the Access to Information and Privacy (ATIP) Branch will undergo a number of changes, including reviewing its policies to better align with legislation, refining a human resources strategy to address our needs, and conducting a strategic program review to improve our business processes. We will also launch an education campaign for employees across the country. Our aim is to increase awareness of our employees' roles and responsibilities when it comes to information.

While the RCMP's change journey is long, we have set the course for where we want to be: a healthy, inclusive organization providing a leading-edge police service to keep Canadians safe.

Organizational structure

RCMP

For nearly 150 years, the RCMP has been Canada's national police service. It is unique in the world since it is a national, federal, provincial, and municipal policing body. The Force provides federal policing services to all Canadians and policing services under contract to the three territories, eight provinces, and more than 180 municipalities, including more than 750 detachments across Canadian communities, 600 Indigenous communities and three international airports.

The RCMP's mandate is multi-faceted and includes preventing and investigating crime; maintaining peace and order; enforcing laws; contributing to national security; ensuring the safety of state officials, visiting dignitaries and foreign missions; and providing vital operational support services to other police and law enforcement agencies within Canada and abroad.

The organization is sub-divided into 16 divisions (10 provinces and 3 territories) and National Headquarters in Ottawa, each of which is under the direction of a Commanding Officer or Director General. National Headquarters includes nine business lines and is structured as follows: Federal Policing; Contract and Indigenous Policing; Specialized Policing Services; Corporate Management; Human Resources; Internal Audit and Evaluation; Legal Services; Office of the Ethics Advisor; and Strategic Policy and, External Relations Directorate.

Access to Information and Privacy (ATIP) Branch

The RCMP established the ATIP Branch in 1983, as the central contact point for matters arising from both the Access to Information and Privacy Acts.

The ATIP Branch falls within the RCMP's Strategic Policy and External Relations Directorate. The Director of the Branch acts on behalf of the head of the institution as the Departmental Access to Information and Privacy Coordinator for the RCMP. The ATIP Coordinator ensures compliance with both the spirit and the intent of the Access to Information and Privacy Acts, as well as all associated regulations and guidelines.

As described below, the ATIP Branch is divided into two major areas:

Disclosure Team (Operations): This team processes all formal requests under the Access to Information and Privacy Acts. This includes: working with requesters to discuss scope and clarity of their submissions; opening requests; and, tasking and receiving/importing records to and from Liaison Officers (LOs) within the RCMP's various business lines and divisions from across the country. The team also reviews records and provides disclosed pages to requesters. As well, they process informal access to information requests, review, and respond to complaints received through both the Offices of the Information and Privacy Commissioners.

When tasking requests, the Branch works closely with LOs and record holders, known as Office of Primary Interest (OPIs). Some responsibilities of the LOs and OPIs include:

• Liaison Officers (LOs): They are responsible for forwarding all ATIP requests to the appropriate personnel (OPIs) within their business lines or divisions. Other responsibilities include: tracking submissions to ensure responsive records are sent by OPIs to the ATIP Branch; ensuring records are on time; and documenting, and communicating internal RCMP ATIP processes to all who facilitate the processing of requests.

• Office of Primary Interest (OPIs): As the record holders, some of their responsibilities include: providing electronic copies of the responsive records; reviewing records for duplication; ensuring that the information falls within the scope of the request; notifying the ATIP Branch if records are voluminous; and, advising the Branch or LO if an extension is required.

Policy Team: This team monitors and develops internal policies, procedures and guidelines for the collection, retention, disposition, use and disclosure of all personal and non-personal information for RCMP-wide applications. It also offers support to ATIP analysts and the RCMP ATIP Coordinator, provides guidance to RCMP business lines and divisions across Canada with respect to section 4 to 8 of the Privacy Act. In addition, the Team reviews and creates internal policies that reflect Treasury Board Secretariat policies and directives as well as expectations of the Office of the Privacy Commissioner in order to meet its obligations in relation to the Info Source and Privacy Impact Assessments within the RCMP.

Delegation Order

The Departmental Access to Information and Privacy Coordinator has full authority to administer the legislation and apply exemptions and releases. A copy of the signed Delegation Order is included in Appendix A.

Performance

This section provides on overview of the RCMP's performance with respect to information requested under the Privacy Act for the 2019-2020 reporting year. The completed statistical report is found in Appendix B.

Impact of COVID-19 and mitigation measures

Due to the COVID-19 pandemic, the RCMP experienced added challenges during the reporting period. As with other non-critical services within the RCMP, employees of the ATIP Branch teleworked with limited capacity during the last two weeks of March. This resulted in some employees not being able to perform their duties and some experienced technical difficulties in processing requests. As well, most LOs and OPIs were delivering critical services and had limited abilities in responding to the ATIP Branch during this period. Not withstanding these challenges, the Branch implemented temporary measures to ensure Canadians continued to receive information during this period. Such measures included: putting in place safeguards to efficiently retrieve disclosed files; reprioritizing requests to better meet timelines; electronically releasing smaller sized consultations; and implementing a gradual return to tasking LOs and OPIs in the first quarter of the 2020-2021 fiscal year. As well, Branch employees continued to open online requests, retrieve electronic records and review backlogged files.

Compliance

The ATIP Branch saw a slight decrease in compliance for the number of closed requests within the legislated timeframes under the Privacy Act. Compliance decreased to 38.6% from 40.96% in 2018-2019 fiscal year. The decrease is largely due to capacity challenges within the Branch to address complex and voluminous requests. Further, limited resources were challenged with an increase of 150% for the number of requests containing 5,000 or more pages compared to the 2018-2019 reporting period. As well, because of the COVID-19 pandemic, the RCMP had limited capacity during the last two weeks in March.

Requests received and closed

As noted in the statistical report in Appendix B the RCMP received a total of 3,661 new requests under the Privacy Act in 2019-2020. In addition, there were 3,490 requests outstanding from the previous reporting period for a total of 7,151 requests. Of these, 4,510 requests were completed and 2,641 carried over to the 2020-2021 fiscal year.

Generally, privacy requests cover a variety of topics, including information on police operational files such as motor vehicle accidents and employment files.

As demonstrated below, there have been decreases in requests received compared to the last two reporting periods. The number of requests received decreased by 15% compared to the previous fiscal year and decreased by 28% compared to the 2017-2018 fiscal year.

The graph also demonstrates that the number of requests closed this reporting period decreased by 6% compared to the previous fiscal year. However, there was a 46% increase compared to the 2017-2018 fiscal year.

Workload

Chart 1: Workload - Text version

Chart 1: Workload

Year	Received	Outstanding	Completed	Carried over
2017-2018	4996	2097	3084	4009
2018-2019	4289	4009	4808	3490
2019-2020	3661	3490	4510	2641

Number of requests processed with over 5,000 pages

Over the past three fiscal years, the RCMP has seen a significant increase in the requests processed with over 5,000 relevant pages disclosed. For the current reporting period of 2019-2020, there has been an increase of 160% for the number of such requests compared to the 2018-2019 fiscal year and an increase of 520% compared to the 2017-2018 fiscal year.

Chart 2: Text description - Number of requests with over 5,000 pages processed

Chart 2: Number of requests with over 5,000 pages processed

Year	Number of requests	Total pages disclosed
2017-2018	4	5287
2018-2019	8	17633
2019-2020	20	43369

Completion time and extensions

Completion rate of closed requests

The Branch completed 23% (1,043) of its requests in 30 days or less. During the reporting period, 17% (744) of the requests were completed within 31-60 days, 13% (586) were completed in 61-120 days and 47% (2,137) were completed in more than 121 days.

Extensions of over 30 days were sought on 3,678 files. This can be attributable to the number of requests with a large volume of pages. During this reporting period, the ATIP Branch processed 20 requests with more than 5,000 pages disclosed. In the previous fiscal year, there were only eight requests with such high page numbers and only four in the 2017-2018 fiscal year.

Chart 3: Text description - Completion rate of closed requests

Chart 3: Text description - Completion rate of closed requests

Year	0-30 days	31-60 days	61-120 days	over 121 days	Totals
2017-2018	859	654	657	914	3084
2018-2019	1184	846	422	2356	4808
2019-2020	1043	744	586	2137	4510

Disposition of completed requests

Of the 4,510 requests completed in the 2019-2020 fiscal year, the dispositions of completed requests were as follows:

• 299 (7%) requests were all disclosed;
• 2,476 (55%) requests were disclosed in part;
• 148 (3%) requests had all material exempted;
• 3 (0%) requests had all material excluded;
• 429 (9%)requests had no records located;
• 1,130 (25%) requests were abandoned by requesters; and,
• 25 (1%) requests were neither confirmed nor denied.

Chart 4: Text description - Disposition of completed requests

Chart 4: Text description - Disposition of completed requests

Disposition of Requests	Total
All disclosed	299
Disclosed in part	2,476
All exempted	148
All excluded	3
No records exist	429
Request abandoned	1,130
Neither confirmed nor denied	25
Total	4,510

Consultations for other institutions

All consultations received and completed

The number of consultations received and completed over the last three reporting periods has stayed relatively the same. During the reporting period, the RCMP completed 144 consultations, totaling 3,964 pages reviewed. Of the 144 completed consultations, 74 were received from other Government of Canada institutions and 70 were other organizations.

Chart 5: Text description - All consultations received and completed

Chart 5: Text description - All consultations received and completed

Fiscal year	Requests		Pages
	Received	Completed	Received	Completed
2017-2018	168	182	7345	28423
2018-2019	157	150	7391	6235
2019-2020	144	143	3964	5166

Training and awareness

Training is a priority for the RCMP's ATIP Branch. Employees are encouraged and supported to enroll in various courses as a means to gain knowledge and improve their skills.

For the 2019-2020 reporting year, units within the ATIP Branch held regular information sharing sessions where employees discussed and reviewed recent files with the goal of sharing best practices. An informal mentoring program was set-up during the 2019-2020 fiscal year. Senior analysts acted as mentors and provided guidance to junior analysts. This initiative forms part of the Branch's human resources strategy for succession planning and employee retention.

One employee in the Branch's Intake team coached and trained their peers, which has resulted in more stability for this unit. All new employees joining this team received this coaching. As well, other units within the Branch were trained to assist the Intake team during busy times.

Five preliminary training sessions on reviewing files were also provided to the members of the Intake team and junior analysts within the Branch. Two more advanced practical training sessions were provided following the initial sessions. Approximately 20 participants attended the sessions, which introduced concepts they would need while reviewing files. Following the practical training sessions, mentors continued to provide guidance and advice to the participants.

Two training sessions were provided to personnel within the RCMP's Resource and Conduct Adjudications Directorates. A total of 37 participants attended this training, which included: an introduction to the Access to Information and Privacy Acts, guidelines and commonly used exemptions within the RCMP; a review of common requests received for the Directorates; and, an overview of the ATIP Branch's role and responsibilities within the Directorates. The training also included practical discussions on different scenarios and how the legislation would affect the Directorates' responsibilities.

The Branch also provided training to six business lines within the RCMP's National Headquarters. This training included a review of the ATIP Branch's roles and responsibilities and an introduction to the Access to Information and Privacy Acts, legislation and guidelines. It also included an overview of Bill C-58 and the importance of meeting the legislative requirements for proactive disclosure. Similar training was also provided to LOs in Prince Edward Island and in Nova Scotia.

Personnel within the ATIP Branch also received additional training during Branch town halls. During the November 2019 town hall, employees were updated on Bill C-58. Topics during other town halls included updates on modified processes in file reviews and criminal records exemptions.

As part of the ATIP Branch's Management Response to the internal audit of 2018, the Branch in conjunction with the RCMP's Learning and Development unit has recently started developing an online ATIP introductory course to be delivered to all RCMP employees. This training is to provide RCMP employees across the country with knowledge of ATIP legislation and procedures so that they can more effectively comply with current legislation and RCMP policies.

Policies, guidelines, procedures and initiatives

The ATIP Branch continued to review its processes to improve operational effectiveness. During the reporting period of 2019-2020, the Branch accomplished the following:

• reviewed employee work arrangements and established new telework agreements to allow more flexibility for its ATIP personnel;
• updated the Intake team's standard operating procedures, which was part of the Branch's task of formalizing its internal processes;
• enhanced internal processes for facilitating the transfer of files within the RCMP;
• developed guidelines to address its backlog, enabling processing efficiencies;
• purchased and installed new servers and higher capacity computer systems, allowing the Branch to gain efficiencies;
• established an internal working group of various stakeholders within the RCMP for the development of guidelines, standard operating procedures and awareness communiques to facilitate proactive disclosure requirements under Bill C-58; and,
• established and led the interdepartmental working group for the development of business continuity plans specifically for ATIP programs, which led to greater information sharing among the participating departments.

Additionally, the ATIP Policy Unit completed the following:

• Reviewed its policy on paragraph 8(2)(e) – Privacy Act Request to other federal institutions and initiated a review of its Exempt Bank policy in collaboration with interested stakeholders.
• Developed Standard Operating Procedures on disclosures in accordance with subsections 8(2)(e) and (m) of the Privacy Act and on privacy compliance complaints. The latter includes a handbook describing the ATIP Branch and OPI's responsibilities regarding complaints. It also offers guidance on formulating representations to the Office of the Privacy Commissioner.
• Developed, in accordance with Treasury Board Secretariat (TBS) Policy on Privacy Protection, a protocol for collecting, using or disclosing personal information for non-administrative purposes, including research, statistical, audit and evaluation purposes.

Summary of key issues and actions taken on complaints or audits

Complaints and investigations

During this reporting period, the RCMP continued to work collaboratively with the Office of the Privacy Commissioner to streamline processes in addressing complaint files.

To enable the RCMP to respond more efficiently to complaints received through the Offices of the Information and Privacy Commissioners, a complaints team was created in November 2017. The team, which has grown from two members to seven and now includes some consultants, has been working persistently on responding to complaints.

Section 8 of the Statistical Report (Appendix B) also provides data on the complaints received and closed. Specifically for the 2019-2020 reporting period, the RCMP received and provided the following under the Privacy Act:

• For Section 31, received 159 notices, which represents less than 4% of all requests closed during the reporting period. The majority of the privacy complaints received relate to being late and in deemed refusal, which can be attributable to the RCMP having a backlog and receiving complex and/or voluminous requests. Under this section, the OPC formally notifies the institution of their intent to investigate a complaint received of a request.
• For Section 33, made no formal representations. Under this section, the OPC requests representations from both the complainant and the institution pursuant to an ongoing complaint investigation.
• For Section 35, received 17 'report of findings' with recommendations from the Privacy Commissioner. This represents 11% of the complaint notices received. Under this section, the OPC issues a findings report, which may include recommendations, for a well-founded complaint upon the conclusion of the investigation.

Court action

In addition, three court proceedings were actioned with respect to requests processed and all were concluded during the reporting period.

ATIP program internal audit

An internal audit of the ATIP program was conducted by the RCMP's Audit and Evaluation unit. The audit examined the processes and controls, which were in place within the RCMP to support compliance with the Access to Information and Privacy Acts. The audit scope included activities carried out from April 1, 2016 to March 31, 2018. It concluded that a governance framework was in place to support the program but opportunities existed to enhance the processes and controls of the program.

The ATIP Branch continuously reviews its processes to improve the operational effectiveness and efficiency of the program. Specifically to address the internal audit, the Branch is developing and advancing key enhancements to the program and they include reviewing and updating internal policies; reviewing business processes; developing online training and tools; and refining its human resources strategy and structure.

Monitoring compliance

The ATIP Branch monitors compliance through weekly statistical reports that include compliance rate, the number of on time and late files and complaints. Performance is also compared to previous fiscal years to identify trends. The Branch's Management team reviews the weekly reports to manage workload and to determine any upcoming issues where processes could be improved. The reports are provided to the Chief Strategic Policy and External Relations Officer and recently to the RCMP's Chief Administrative Officer.

The Branch is currently considering various reporting systems with dashboard capabilities. The new system will capture and provide pertinent data to assist the Branch with its tactical and strategic planning.

Material privacy breaches

As Canada's national police force, the RCMP is trusted to handle and protect the personal information of Canadians with professionalism and integrity, a job it takes very seriously. To safeguard the personal information in its care, the RCMP has strict policies and procedures in place to prevent unauthorized access and disclosure across the organization. However, even with rigorous procedures in place, privacy breaches still occur. With every privacy breach, the RCMP takes steps to improve its processes, further ensuring that similar incidents do not occur again.

When a privacy breach is detected, the RCMP's ATIP Branch follows TBS guidelines to determine the privacy risks and reports all breaches, deemed material, to the Office of the Privacy Commissioner and TBS.

During the 2019-2020 fiscal year, the RCMP reported a total of seven material privacy breaches to the Office of the Privacy Commissioner and TBS. Below is a brief description of the breaches and actions taken:

• In the first case, an employee improperly accessed electronic police files related to the ex-spouse of a family member for personal purposes and used part of this information in a sworned affidavit in support of the family member involved in a child custody case. A Code of Conduct investigation is ongoing for this employee.
• In the second case, a sensitive briefing note email, intended for a limited number of RCMP senior management officials, was inadvertenly sent to the wrong proxy email address. This proxy address further disseminated the email to another eight RCMP email proxy addresses. The RCMP's Information Management and Technology Branch is working to restrict the number of recipients through the non-sensitive RCMP reporting email proxies for future reporting.
• In the third case, an RCMP police officer recorded a witness statement on his personal cell phone for a public complaint investigation. The audio recording was accidentally erased following a software update. There is no evidence that the information contained within the statement, which was erased, was improperly accessed. The police officer involved was provided guidance on proper police investigation procedures, including the proper handling and retention of police evidence. The RCMP Commissioner has directed that the RCMP's national policy be updated to provide greater clarity that personal devices should not be used for recording statements unless exigent circumstances exist.
• In the fourth case, a partial security clearance file was sent from National Headquarters in Ottawa to a provincial office through internal mail, however the package was never received. The RCMP's Departmental Security Branch now requires National Headquarters mailroom to provide tracking numbers for all envelopes sent through its facility.
• In the fifth case, two mail packages sent from the National Sex Offender Registry Office in Regina were sent to registered sex offenders, however it appears the incorrect mailing labels were placed on the packages resulting in each addressee receiving the other's information. Following this incident, the individual in charge of the National Sex Offender Registry Office issued, an all-employee directive for the unit, new procedures for mailing information to clients.
• In the sixth case, a sensitive briefing note, intended for a limited number of RCMP senior management, was inadvertenly sent to the wrong proxy email address. The briefing note described an off-duty incident involving an RCMP police officer and the fact that charges were pending. The RCMP's Information Management and Technology Branch is working to rename the various proxy addresses as they are named too similarly.
• In the last case, an employee's security file was misplaced through the internal mail system, however, it was later found in an offsite RCMP storage facility. The unit involved implemented a new procedure to ensure transmittal forms are completed for every file that is handled by them.

Privacy impact assessments

During the reporting period, the RCMP completed four Privacy Impact Assessments (PIAs) and submitted the following PIAs to the Office of the Privacy Commissioner:

• Shift Scheduling and Exception Pay Processing Reporting and Analytics (SSEPP),
• Criminal Intelligence Service Canada's (CISC) Automated Criminal Intelligence Information System (ACIIS) database,
• In-Car Digital Video System, and
• A PIA addendum for Covert Administration System – Witness Protection (CAS – WP).

The PIAs for Shift Scheduling and Exception Pay Processing Reporting and Analytics (SSEPP), Criminal Intelligence Service Canada's (CISC) Automated Criminal Intelligence Information System (ACIIS) database were also submitted to TBS as they required changes to related Personal Information Bank (PIB).

A short description of each PIA is detailed below and the complete executive summaries for these programs are available on the RCMP website at: https://www.rcmp-grc.gc.ca/en/privacy-impact-assessments.

The three completed PIAs were carried forward from previous fiscal years. The completed PIA addendum was received during the reporting period and seven PIAs that were carried forward from previous fiscal years are pending completion by RCMP requesting OPIs.

RCMP OPIs submitted four new PIAs to the ATIP Branch during the reporting period. Three of the four new PIAs required a preliminary review by the Branch. As well, during the 2019-2020 fiscal year, the Branch responded to 162 PIA-related queries and reviewed 54 PIA questionnaires to determine if a PIA was needed.

Public interest disclosures

During the 2019-2020 fiscal year, 23 disclosures were made pursuant to paragraph 8(2)(m) of the Privacy Act. The disclosures related to either the duty status of charged RCMP employees or the release of dangerous offenders into communities across Canada. Due to the nature of these disclosures, the majority of the notifications are made to the Office of the Privacy Commissioner after the disclosure.

Appendix A - Delegation order

Appendix B – Statistical Report on the Privacy Act

Section 1: Requests Under the Access to Information Act

Section 2: Requests closed during the reporting period

2.2 Exemptions

2.3 Exclusions

2.4 Format of information released

2.5 Complexity

2.6 Closed requests

2.7 Deemed refusals

Section 3: Disclosures under subsections 8(2) and 8(5)

Section 4: Requests for correction of personal information and notations

Section 5: Extensions

Section 6: Consultations Received From Other Institutions and Organizations

Section 7: Completion Time of Consultations on Cabinet Confidences

Section 8: Complaints and investigations notices received

Section 9: Privacy Impact Assessments (PIA) and Personal Information Banks (PIB)

Section 11: Resources Related to the Privacy Act

Note: Enter values to two decimal places.

Appendix C - Supplemental Statistical Report on the Privacy Act – Requests affected by COVID-19 measures

The following table reports the total number of formal requests received during two periods; 2019-04-01 to 2020-03-13 and 2020-03-14 to 2020-03-31.

The following table reports the total number of requests closed within the legislated timelines and the number of closed requests that were deemed refusals during two periods 2019-04-01 to 2020-03-13 and 2020-03-14 to 2020-03-31.

The following table reports the total number of requests carried over during two periods; 2019-04-01 to 2020-03-13 and 2020-03-14 to 2020-03-31.

Date modified:

2020-11-13