2024-2025 Annual Report on the Administration of the Privacy Act

Introduction

The purpose of the Privacy Act is “to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and that provide individuals with a right of access to that information.” The law also protects an individual’s privacy by preventing others from having access to that personal information and allows an individual specific rights concerning the collection and use of their information.

Section 72 of the Privacy Act requires that the head of every government institution prepare for submission to Parliament an annual report on the administration of the Act within the institution during each financial year.

This annual report is tabled in Parliament pursuant to section 72 of the Privacy Act and describes how the Federal Economic Development Agency for Northern Ontario (FedNor) administered its responsibilities for the reporting period.

Institutional mandate

FedNor is the Government of Canada's economic development organization for Northern Ontario, and as such, it is key to helping deliver on the federal government's Prosperity and Growth Strategy for Northern Ontario.

Through its programs and services, and through its financial support of projects that lead to job creation and economic growth, FedNor works with businesses and community partners to build a stronger Northern Ontario.

Organizational structure

For the purposes of the Privacy Act, the President of FedNor has delegated powers, duties and functions under the Act to the Manager of Government Affairs who, among other duties, performs the role of Access to Information and Privacy (ATIP) Coordinator responsible for leading the ATIP Program. The ATIP Coordinator administers the Act with assistance from an administrative officer.

The ATIP Coordinator is responsible for all daily ATIP activities and operations, as well as the development, coordination and implementation of effective policies, guidelines and procedures necessary to manage the agency's compliance with the Acts. The ATIP Coordinator responds to all formal requests submitted under the applicable Act.

FedNor has no new or pre-existing service agreement under section 73.1 of the Privacy Act.

Delegation of authority

A copy of the Delegation Order that was in effect at the end of the reporting period is attached in Annex A. It provides delegated authority to the Vice President of Policy and Communications, the Director of Program Policy and the Manager of Government Affairs (the ATIP Coordinator).

Performance in 2024-2025

FedNor received no requests under the Privacy Act during the reporting period. FedNor’s 2024−2025 Statistical Report on the Privacy Act is attached as Annex B. Therefore, there is no information to report for the following reporting components prescribed by the Treasury Board of Canada Secretariat (TBS):

• Percentage of responses within legislated timelines
• Number of completed requests
• Number of active requests
• Number of active complaints
• Reasons for extensions
• Consultations completed
• Percentage of requests for which records were all disclosed and disclosed in part

Training and awareness

To date, a total of 67 employees completed the previously mandatory course Access to Information and Privacy Fundamentals offered by the Canada School of Public Service. FedNor will continue to require that all employees complete the course.

Informal briefings were provided to the ATIP Coordinator by a part-time ATIP support officer on the requirements related to the collection, creation, use and retention of personal information.

Policies, guidelines and procedures

FedNor drafted a Privacy Breach Management Process that reflects best practices and provides guidance to employees on how to address privacy breaches. FedNor has also drafted a Privacy Protocol for any program or activity that uses personal information for a non-administrative purpose. The procedures and the privacy protocol will be implemented in the next reporting period.

Initiatives and projects to improve privacy

No such initiatives or projects were implemented since FedNor has never received a privacy request under the Privacy Act and collects very little personal information.

Summary of key issues and actions taken on complaints

As FedNor never received or concluded any complaints under the Privacy Act, FedNor has no information to report on this subject.

Material privacy breaches

There were no material privacy breaches that had to be reported to the Office of the Privacy Commissioner of Canada or to the TBS during the reporting period.

Privacy impact assessments

FedNor did not complete a privacy impact assessment during the reporting period.

Public interest disclosures

Paragraph 8(2)(m) of the Privacy Act gives heads of institutions the discretion to disclose personal information where disclosure would clearly benefit the individual to whom the information pertains or when the interest in public disclosure clearly outweighs the privacy of the concerned individual.

FedNor made no such disclosures during the reporting period.

Monitoring compliance

In consideration of having received no requests under the Privacy Act since becoming a fully independent agency of the Government of Canada, FedNor has not developed any strategies to control delays in processing requests.

FedNor uses the Security Requirement Check List (SRCL) form for contracts involving personal information. The form supports compliance by ensuring that contractors and employees handling personal information meet security standards and privacy protection requirements.

Therefore, no monitoring was conducted during the reporting period to ensure that appropriate privacy protections were included in service contracts.

FedNor has no information sharing agreement or arrangement in place.

Annex A: Delegation of ATIP authority

FEDERAL ECONOMIC DEVELOPMENT AGENCY FOR NORTHERN ONTARIO ACCESS TO INFORMATION AND PRIVACY ACT DELEGATION ORDER

AGENCE FÉDÉRALE DE DÉVELOPPEMENT ÉCONOMIQUE POUR LE NORD DE L’ONTARIO ARRÊTÉ DE DÉLÉGATION EN VERTU DE LA LOI SUR L’ACCÈS A L’INFORMATION DE LA LOI SUR LA PROTECTION DES RENSEIGNEMENTS PERSONNELS

Signed in Gatineau on this 20 day of June, 2023
Signé à Gatineau, le 20 jour de juin 2023

Valerie Gideon, President
Federal Economic Development Agency for Northern Ontario
Valerie Gideon, Présidente
Agence fédérale de développement économique pour le Nord de l'Ontario

Annex B : Annual statistical report on the Privacy Act

Name of institution: Federal Economic Development Agency for Northern Ontario
Reporting period: 2024-04-01 to 2025-03-31

Section 1: Requests under the Privacy Act

1.1 Number of requests received

1.2 Channels of requests

Section 2: Informal requests

2.1 Number of informal requests

2.2 Channels of informal requests

2.3 Completion time of informal requests

2.4 Pages released informally

Section 3: Requests closed during the reporting period

3.1 Disposition and completion time

3.2 Exemptions

3.3 Exclusions

3.4 Format of information released

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper and e-record formats

3.5.2 Relevant pages processed per request disposition for paper and e-record formats by size of requests

3.5.3 Relevant minutes processed and disclosed for audio formats

3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests

3.5.5 Relevant minutes processed and disclosed for video formats

 3.5.6 Relevant minutes processed per request disposition for video formats by size of requests

3.5.7 Other complexities

3.6 Closed requests

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines

3.7.2 Requests closed beyond legislated timelines (including any extensions taken)

3.8 Requests for translation

Section 4: Disclosures under Subsection 8(2) and 8(5)

Section 5: Requests for correction of personal information and notations

Section 6: Extensions

6.1 Reasons for extensions

6.2 Length of extensions

Section 7: Consultations received from other institutions and organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

7.3 Recommendations and completion time for consultations received from other Government of Canada institutions

Section 8: Completion time of consultations on Cabinet confidence

8.1 Requests with legal services

8.2 Requests with Privy Council Office

Section 9: Complaints and investigations notices received

Section 10: Privacy impact assessments (PIAs) and personal information banks (PIBs)

10.1 Privacy impact assessments

10.2 Institution-specific and central personal information banks

Section 11: Privacy Breaches

11.1 Material privacy breaches reported

11.2 Non-material privacy breaches

Section 12: Resources related to the Privacy Act

12.1 Allocated costs

12.2 Human resources