2024-2025 Annual Report to Parliament: Privacy Act

Table of contents

Introduction

roman numeral 1. Introduction

The purpose of the Privacy Act (PA) is to provide access protect the privacy of individuals with respect to their personal information. This Act governs the federal government's responsibilities for the collection, retention, use and disclosure of that information. It also grants individuals the right to access their own personal information held by these institutions, with some exceptions, and to requests corrections if the information is inaccurate.

This report reflects activities of Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC), in respect to the stated legislation, for the period of April 1, 2024 to March 31, 2025.

This report, submitted to Parliament pursuant to section 72 of the PA, describes the activities of CIRNAC that support compliance with privacy legislation.

Crown-Indigenous Relations and Northern Affairs Canada's Mandate

Crown-Indigenous Relations and Northern Affairs Canada continues to renew the nation-to-nation, Inuit-Crown, government-to-government relationship between Canada and First Nations, Inuit and Métis; modernize Government of Canada structures to enable Indigenous Peoples to build capacity and support their vision of self-determination; and lead the Government of Canada's work in the North.

The relationship must be based on the recognition of rights, respect, co-operation, and partnership. CIRNAC will build on the progress that has been already made, including the establishment of rights and recognition tables across the country, the strengthening of relationships with National Indigenous Organizations to make progress on shared priorities, and the progress made across government on the Truth and Reconciliation Commission Calls to Action.

CIRNAC is one of two federal departments that are primarily responsible for meeting the Government of Canada's obligations and commitments to First Nations, Inuit and Métis, and for fulfilling the federal government's constitutional responsibilities in the North. CIRNAC's overall mandate and wide-ranging responsibilities are shaped by centuries of history and unique demographic and geographic challenges. The mandate is derived from the Constitution Act 1982, the Indian Act, the Department of Crown-Indigenous Relations and Northern Affairs Act (preceded by the Department of Indian Affairs and Northern Development Act), territorial Acts, treaties, comprehensive claims and self-government agreements, as well as various other statutes affecting Indigenous Peoples and the North.

roman numeral 2. Organization

Administration of the Access to Information Act at Crown-Indigenous Relations and Northern Affairs Canada

CIRNAC's Access to Information and Privacy Office (ATIPO) receives requests for records from the Canadian public and processes them on behalf of the Minister and the Department. They perform their duties under the ATIAand the Privacy Act (PA) and through a Ministerial delegation order.

The ATIP Office is situated in the Corporate Secretariate.The Corporate Secretary is a member of the CIRNAC Senior Management Table.

The ATIP Office also coordinates and implements policies, guidelines and procedures to ensure departmental compliance with the ATIA and PA. Workshop presentations, training courses and awareness sessions designed to increase access to information and privacy capacity across the Department are also provided.

Under section 96, CIRNAC provides shared ATIP services to Indigenous Servies Canada (ISC) through a Service Level Agreement (SLA). The SLA is updated yearly and ISC's Corporate Secretary is responsible for its approval within their department.

Delegation of ministerial responsibilities for the ATIA and PA remains institutionally specific.

Under a shared service model, all ATIP analysts process requests for both CIRNAC and ISC. Requests are varied in volume and complexity.

The ATIP Office provides advice and guidance to both departments on a number of topics:

  1. Application of the ATIA and PA;
  2. Release of sensitive or protected information to the public;
  3. Education and awareness of access to information and privacy issues throughout the Department; and
  4. Proactive publications.

The Intake Team triages and coordinates the receipt of requests for records from the Canadian public or persons residing in Canada under the control of the Department and made pursuant to the ATIA and PA.

The Operations Team processes records in line with the ATIA and PA. The Team is responsible for providing the responses within the legislated timeframe.

In addition to the ATIP Office, within each of the sectors and regional offices of CIRNAC there are ATIP Liaison Officers (ALOs) who receive callouts from the ATIP Office and subsequently task the requests to areas within their sector to retrieve records. ALOs play a crucial role in ensuring the appropriate records, impact statements and approvals are obtained and communicated to the ATIP Office within the designated time allowances.

ATIP analysts work closely with the relevant program areas in order to ensure that all responsive documents are identified and that the information contained within those documents are treated in accordance with the Acts. This work ensures departmental records are appropriately disclosed to the Canadian public in support of openness and transparency.

All requests are monitored and processed using the AccessPro case management system. The ATIP Office will be transitioning away from this sunsetting case management system. A new system called ATIPXpress has been procured. This solution was chosen to increase efficiency by reducing processing times and moving away from a more manual system. It will improve departmental compliance with legislative timelines, alleviate pressures from both the Office of the Information Commissioner (OIC), and the Privacy Commissioners of Canada (OPC) and improve service to the Canadian public. This new case management system provides a supported, stable, and technologically contemporary tool to manage both department's workloads fluidly within one system, further cutting processing time. The solution is expected to be implemented in fiscal 2025-2026.

ATIP Operations is working on updating and formalizing their Developmental Program in order to recruit and retain qualified analysts with specialized skills. The multi-phased program is based on performance benchmarks that clearly state the expectations at each level from CR-04 to PM-06. An employee can choose to participate in the program to develop their skills, build experience and advance their careers within the organization. With guidance from the Team Leaders, analysts can gain specialized expertise related to CIRNAC's unique record sets.

This program is developed with the intent to be open and transparent in order to develop and retain current staff and provide growth opportunities within the ATIP Office and the Department. The pilot Developmental Program has been highly successful. This reporting period, eleven analysts were promoted or provided acting opportunities based on their success in the program.

The Department has continued to meet its proactive publication requirements in this reporting period and has published briefing material titles submitted to the Minister and Deputy Minister on a monthly basis. It has also published the summaries of the completed requests on the Open Government Portal, thereby continuing to improve communication with Canadians and promoting transparency.

The Department continued to use the Microsoft Office 365 tools, to communicate internally and engage with key stakeholders. The ATIP Office leveraged these tools for the transfer of information with sectors to allow for business continuity within the hybrid workplace structure.

To better serve our clients, the Department participates in the Access to Information and Privacy Online Request Service. Canadians can submit requests under the Acts through this online channel administered by TBS.

The ATIP Office continues to work in a hybrid model. Since pandemic response conditions substantially reduced the use of paper, the office mostly received electronic requests and records. It provided release packages electronically to applicants with the use of E-post Connect, which was implemented in February 2020.

roman numeral 3. Delegation Order

Under section 73 of the PA, the Minister's authority may be delegated to departmental officials in order to administer the PA within CIRNAC.

During the reporting period, the delegation order signed by the Honorable Minister Carolyn Bennett, Minister of Crown-Indigenous Relations on January 28, 2021, was in effect (Annex A).

Under section 73 of the PA, the order delegates full authority and responsibility for the PA to the following positions:

  • Deputy Minister
  • Associate Deputy Minister
  • Corporate Secretary
  • Departmental ATIP Director (Coordinator)
  • ATIP Deputy Directors

Director's Office

The Director (EX-01), as institutional ATIP Coordinator, holds full delegated authority under the ATIA. The Director is supported in day-to-day administrative tasks by the Deputy Director Operations (PM-06), Deputy Director Privacy/Policy (PM-06), an Administrative Assistant (AS-01) and is also supported in reporting by the Systems Administrator (AS-04).

Privacy/Policy Team

The Privacy/Policy Team is led by two Team Leaders (PM-05), who are responsible for ensuring the department is adhering to the collection, use and disclosure of personal information holdings as per the PA. They also ensure all policies for Access and Privacy align with Treasury Board policies and directives. The Privacy/Policy Team consists of Analysts at the PM-04, PM-03 and PM-02 levels who respond to privacy policy matters (such as privacy breaches, court ordered disclosure requests, Privacy Assessments, etc.) and provide training and Privacy advice. They are supported by an Intake Clerk (CR-04).

Operations Team

The Operations Team is led by three Team Leaders (PM-05), who are responsible for the overview of request processing by their team, including the review of completed requests. The Operations Team consists of Analysts at the PM-04, PM-03, and PM-02 levels who process Access and Privacy requests of varying volume and complexity, as well as provide training.

Intake Team

The Intake Team is led by one Team Lead (PM-5) and is comprised of various Intake Officers (PM-01s and CR-04s), who enter all applications into the electronic case management system, acknowledge receipt of requests, perform imaging services, interact with and respond to inquiries from the public.

Performance

roman numeral 4. Interpretation of the Statistical Report

CIRNAC's Statistical Report and Supplemental Report were submitted to the Treasury Board Secretariat (TBS) on

July 15th, 2024 (Annex B). The Report details various aspects of privacy requests CIRNAC received and processed during the period of April 1, 2023 to March 31, 2024.

1. Requests under the Privacy Act

1.1 Number of requests received

In 2024-2025, CIRNAC received 384 requests with another 7 requests carried over from the previous year. This reflected a total of 391 requests to be processed in the course of the reporting period. The Department completed 292 requests and carried 99 requests into the next reporting period (2025-2026).

The 384 privacy requests received represented an increase of 717.02% compared to the 47 requests received in 2023–2024. The significant surge in requests is largely driven by the Indian Boarding School settlement.

Table 1.1 Number of Requests from 2021-2025
Number of Requests 2021-2022 2022-2023 2023-2024 2024-2025
Received during reporting period 945 622 47 384
Outstanding from previous reporting period 117 52 6 7
Total 1062 674 53 391
Table 1.1b 2021-2025 Number of requests closed and carried over to next reporting period
Number of Requests 2021-2022 2022-2023 2023-2024 2024-2025
Closed during reporting period 1009 668 46 292
Carried over to next reporting period 53 6 7 99
1.2 Channels of requests

The channels of requests serve to identify the mechanism used by the Canadian public to make a request for their personal information during the current reporting period: Government of Canada online portal, e-mail, mail, phone or fax. In the course of this reporting period, the majority of requests were received through e-mail (Table 1.2).

Table 1.2 Channels of requests
Source Number of Requests
Online 79
E-mail 303
Mail 1
In person 0
Phone 0
Fax 1
Total 384

2. Informal requests

An informal request is defined as a request for copies of previously processed and released privacy requests. No Informal requests were received pursuant to the Privacy Act (PA) in 2024-2025.

3. Requests closed during the reporting period

3.1 Disposition and completion time

During the reporting period, a total of 292 requests were closed. Of these, CIRNAC provided full or partial disclosure responses in 205 cases, representing 70% of all requests processed.

The most common outcome was partial disclosure, which occurred in 153 cases (52%). In 56 instances (19%), no records were found to respond to the request. Additionally, 31 requests (11%) were abandoned by the requester, often due to incomplete submissions or the absence of required authorization for disclosure (see Table 3.1.1).

Table 3.1.1 Percentage of completed files relevant to each disclosures
Text alternative for Table 3.1.1 Disposition of completed requests
Table 3.1.1 Disposition of completed requests
Dispositions Percentage of Requests
All disclosed 18%
Disclosed in part 52%
No records exist 19%
Request abandoned 11%

During the reporting period, CIRNAC processed and closed a total of 292 requests. Of these, 62 requests (21%) were completed within 1 to 15 days of receipt, and an additional 151 requests (52%) were finalized within 16 to 30 days. In total, 213 requests, representing 73% of all completed requests were closed within 30 days of receipt.

A further 61 requests (21%) were completed between 31 and 60 days, while 17 requests (6%) required more than 60 days to complete. These included 12 requests completed within 61 to 120 days, 2 within 121 to 180 days, 3 within 181 to 365 days, and 1 request that took more than 365 days to finalize (see Table 3.1.2).

This distribution reflects CIRNAC's continued commitment to timely processing of requests under the Privacy Act, =with a strong majority resolved within legislated timelines. (Table 3.1.2).

Table 3.1.2 Disposition and completion time
Disposition of requests Completion Time (days)
1-15 16-30 31-460 61 to 120 121 to 180 181 to 365 > 365 Total
All disclosed 3 36 11 2 0 0 0 52
Disclosed in part 4 94 39 10 2 3 1 153
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
No records exist 32 19 5 0 0 0 0 56
Request abandoned 23 2 6 0 0 0 0 31
Neither confirmed nor denied 0 0 0 0 0 0 0 0
Total 62 151 61 12 2 3 1 292
3.2 Exemptions

As seen in previous years, section 26 (personal information of another individual) was the most common exemption invoked during the reporting period (156 times). The only other exemption applied in 2024-2025 was pursuant to section 27 and 27.1 (Solicitor Client Privilege) which was invoked on 2 (two) occasions (Table 3.2).

Table 3.2 Number of requests closed where exemption provisions were invoked
Section Number of requests
26 156
27 1
27.1 1
3.3 Exclusions

In the 2024–2025 reporting period, one exclusion was applied under section 70(1)(a) of the Privacy Act. This provision relates to records that are excluded from the application of the Act because they pertain to Confidences of the Queen's Privy Council for Canada, more specifically related to memoranda for the purpose of which is to present proposals or recommendations to Council.

3.4 Format of information released

During the 2024–2025 reporting period, 204 out of 205 responses were delivered to requesters electronically, either via E-post or email. In one case, records were provided in paper format, reflecting the Department's continued emphasis on digital service delivery while accommodating individual needs when necessary.

3.5 Complexity

The following sections detail several factors affecting the complexity of requests that were completed throughout 2024-2025.

3.5.1 Relevant pages processed and disclosed for paper and e-record formats by size of requests

Of the 292 requests closed during the reporting period, 236 resulted in the retrieval of records, generating a total of 21,855 pages. Of these, 5,479 pages were disclosed to requesters, either in full or in part, in accordance with the provisions of the Privacy Act (see Table 3.5.1).

Table 3.5.1 Relevant pages processed and disclosed.
Number of pages processed Number of pages disclosed Number of requests
21,855 5,479 236
3.5.2 Relevant pages processed per request disposition for paper and e-records formats by size of requests

During the 2024–2025 reporting period, the majority of requests processed by CIRNAC involved relatively low volumes of records. Of the 236 requests that generated records, 204 (86%) resulted in fewer than 100 pages each, accounting for a total of 3,094 pages. An additional 28 requests (12%) fell within the 101–500 page range, contributing 6,169 pages. No requests generated between 501 and 1,000 pages.

A small number of requests involved significantly larger volumes of records. Three requests resulted in between 1,001 and 5,000 pages, totaling 3,728 pages, while one request exceeded 5,000 pages, generating 8,864 pages alone. These high-volume cases were all partially disclosed, highlighting the complexity and scope of certain files processed under the Privacy Act (Table 3.5.2).

Table 3.5.2 Relevant pages processed per request disposition for paper and e-records formats by size of requests.
Disposition < 100 pages 101-500 pages 501-1000 pages 1001-5000 pages > 5000 pages
Requests Pages Requests Pages Requests Pages Requests Pages Requests Pages
All disclosed 51 324 1 158 0 0 0 0 0 0
Disclosed in part 123 2,633 26 5,869 0 0 3 3,728 1 8,864
All exempted 0 0 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0 0 0
Abandoned 30 137 1 142 0 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0 0 0 0 0 0
Total 204 3,094 28 6,169 0 0 3 3,728 1 8,864
3.5.3 Relevant minutes processed and disclosed for audio formats

No audio files were provided to the CIRNAC ATIP office in response to a PA request.

3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests

No audio files were provided to the CIRNAC ATIP office in response to a PA request.

3.5.5 Relevant minutes processed and disclosed for video formats

No video files were provided to the CIRNAC ATIP office in response to a PA request.

3.5.6 Relevant minutes processed per request disposition for video formats by size of requests

No video files were provided to the CIRNAC ATIP office in response to a PA request.

3.6 Closed requests

The following section details the number of privacy requests closed within the legislated timelines.

3.6.1 Number of requests closed within legislated timelines

The Department closed 292 requests, where 251 were closed within legislative timeframes, achieving a compliance rate of 85.95%  (see Table 3.6.1). This marks a notable improvement over the previous year's compliance rate of 76%. The significant surge in requests is largely driven by the Indian Boarding School settlement.

Table 3.6.1 Number of requests closed within legislated timelines
Number of requests closed within legislated timelines 251
Percentage of requests closed within legislated timelines (%) 85.95
3.7 Deemed refusals

When a government institution fails to respond to a request within the time limits set out in the Act (30 calendar days or the length of time taken under an extension), the institution is considered to be in "deemed refusal" (beyond legislative timelines). The following sections detail the number of, and reasons for requests in deemed refusal throughout 2024-2025.

3.7.1 Reasons for not meeting legislated timelines

The majority of deemed refusals or late requests were a result of workload given the significant rise in privacy requests. (Table 3.7.1).

Table 3.7.1 Number of requests closed within legislated timelines
Number of requests closed past the legislated timelines Principal Reasons
Interference with Operations / Workload External Consultation Internal Consultation Other
41 40 1 0 0
3.7.2 Requests closed beyond legislated timelines (including any extension taken)

Requests closed beyond legislated timelines include any files where a request for extension was requested. During this reporting period a total of 41 requests were closed beyond legislative timelines. Of those, 34 requests were closed beyond the legislated timelines with no extension taken and within 15 days beyond the due date. 7 requests were completed beyond the legislative timeline despite applying an extension of 30 days.

Table 3.7.2 Number of days past deadline
Number of days past legislated timelines Number of requests past legislated timeline where no extension was taken Number of requests past legislated timeline where an extension was taken Total
1 to 15 days 19 1 20
16 to 30 days 7 2 9
31 to 60 days 5 0 5
61 to 120 days 2 1 3
121 to 180 days 1 1 2
181 to 365 days 0 1 1
> 365 days 0 1 1
Total 34 7 41
3.8 Requests for translation

During the reporting period, there were no instances where a requester asked for responsive records to be translated to another official language.

4. Disclosure under subsections 8(2) and 8(5)

Permissible disclosure pursuant to subsection 8(2) of the PA describes the circumstances under which personal information under the control of government institutions may be disclosed without the consent of the individual to whom the information pertains. In 2024-2025, CIRNAC made no permissible disclosures under 8(2)(e) or 8(2)(m). The Treasury Board of Canada Secretariat requires these permissible disclosures to be captured in the statistical report.

There were no disclosures authorized under 8(2)(e) pursuant to requests made by investigative bodies as found in the Privacy Act. The PA permits the disclosure of personal information to an investigative body specified in the regulations, on the written request of the body, for the purpose of enforcing any law of Canada or a province or carrying out a lawful investigation, if the request specifies the purpose and describes the information to be disclosed.

There were no disclosures authorized under 8(2)(m) where the head of the institution found that the public interest in disclosure clearly outweighed any invasion of privacy that could result from the disclosure. The PA permits disclosure under 8(2)(m) pursuant to any purpose where, in the opinion of the head of the institution, the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or disclosure would clearly benefit the individual to whom the information relates.

The Office of the Privacy Commissioner must be informed of communications pursuant to paragraph 8(2) (m) as required by section 8(5) PA. This was not necessary in 2024-2025.

Other permissible disclosures not captured by the statistical report include:

There were three (3) disclosures authorized under 8(2)(d) pursuant to a request from the Department of Justice. The PA permits the disclosure of personal information to the Attorney General of Canada for use in legal proceedings involving the Crown in right of Canada or the Government of Canada.

There were thirty-nine (39) disclosures authorized under 8(2)(k) pursuant to requests from the authorized researchers identified in the PA. The PA permits the disclosure of personal information for the purpose of researching or validating the claims, disputes or grievances of any of the aboriginal peoples of Canada. 

The ATIP office authorized a combined total of 42 requests under section 8(2) of the Privacy Act in 2024-2025.

Table 4 Disclosures Under Subsections 8(2)

Table 4 Disclosures Under Subsections 8(2)
Subsections 8(2) Subsection (8)(5)
8(2)(a)Table note 1 8(2)(d) 8(2)(e) 8(2)(f) 8(2)(j) 8(2)(k) 8(2)(m) 8(5)
0 3 0 0 0 39 0 0
Table note 1

8(2)(a) disclosures are only captured when they are new disclosures processed in collaboration with 9(4)

Return to table note 1 referrer

5. Requests for Correction of Personal Information and Notations

During the reporting period, there were no requests for correction of personal information or notations.

6. Extensions

During the 2024–2025 reporting period, CIRNAC invoked a total of 39 extensions pursuant to section 15(a) of the PA, which permits extensions when processing a request would unreasonably interfere with the operations of the institution. All extensions were for a duration of 16 to 30 days.

The majority of these extensions were attributed to the large volume of requests (31 instances), followed by large volume of pages (6 instances), and further review required to determine exemptions (1 instance). One additional extension was taken due to the difficulty in obtaining documents. No extensions were taken for translation, conversion, or consultations (Table 6.1).

Table 6.1 Reasons and days taken for extensions
15(a)(i) Interference with operations 15 (a)(ii) Consultation 15(b)
Further review required to determine exemptions Large volume of pages Large volume of requests Documents are difficult to obtain Cabinet Confidence Section (Section 70) External Internal Translation purposes or conversion
1 6 31 1 0 0 0 0

7. Consultations received from other institutions and organizations

CIRNAC did not receive any consultations from another Government of Canada institutions or other organizations during 2024-2025.

8. Completion Time of Consultations on Cabinet confidences

During the reporting period, one consultation on the application of section 70 of the PA was sent to the departmental Legal Services Unit for consultation on potential Cabinet confidences.

9. Complaints and investigations notices received

During the 2024-2025 reporting period, there were 5 complaints received from the Office of the Privacy Commissioner under section 31. There was 6 complaints closed, resulting in the processing of 15,608 pages processed. The Treasury Board of Canada requires institutions to track sections 31, 33 and 35 of the Privacy Act in the statistical report (Table 9).

Table 9 Complaints and Investigation Notices Received

Table 9 Complaints and Investigation Notices Received
Section 31 Section 33 Section 35 Court action
5 0 5 0

10. Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

10.1 Privacy Impact Assessments

A Privacy Impact Assessment (PIA) is a risk evaluation of the flow of personal information held within a program or service. This process enables the Department to determine whether new or substantially modified technologies, information systems, initiatives, and proposed programs or policies meet federal government privacy requirements. It identifies and mediates privacy risks on programs collecting and using personal information.

The Department completed no new PIAs during the 2024-2025 reporting period, however, has undertaken the review and update of an existing PIA.

10.2 Institution-specific and Central Personal Information Banks

The ATIP Office completed the transfer and realignment of CIRNAC's Institutional Specific Personal Information Banks from the previous departmental designation. This is reflected in the annual publishing of the departmental Info Source Chapter (Info Source: Sources of Federal Government and Employee Information for Crown Indigenous Relations and Northern Affairs Canada). However, the ATIP Office continues to work with sectors to review and update PIBs to ensure their ongoing accuracy and necessity.

10.2. Institution-specific and Central Personal Information Banks
Personal Information Banks Active Created Terminated Modified
Institution-specific 17 0 0 0
Central 0 0 0 0
Total 17 0 0 0

11. Privacy Breaches

11.1 Material Privacy Breaches reported

CIRNAC reported no material breaches during this fiscal year. Material privacy breaches are at the highest risk and impact and are defined as: involving sensitive personal information and could reasonably cause serious injury or harm to the individual, and/or involves a large number of affected individuals.

11.2 Non-Material Privacy Breaches

The ATIP Office completed the investigation and review of 3 non-material privacy breaches.

Table 11.2 Non-Material Privacy Breaches
Number of non-material privacy breaches 3

12. Resources Related to the Privacy Act

12.1 Allocated Costs

In 2024-2025, CIRNAC spent a total of $234,564 on staffing and goods and services. These amounts reflect the level of effort in support of CIRNAC's responsibilities pursuant to the Act (Table 12.1).

Table 12.1 Allocated Costs
Expenditures Amount
Salaries $139,066
Overtime $954
Goods and Services
Professional services contracts $94,544
Other $0
Total Goods and Services $94,544
Total $234,564

roman numeral 5. Training and Awareness

During the reporting period, the ATIP Office provided ATIP 101 training sessions consisting of ATIP awareness and information related to the Access to Information Act and Privacy Act combined. These training sessions provide general ATIP information such as purpose of the Acts, history, as well as general applications of the Acts. Included is departmental specific information such as the most commonly applied exemptions, and information on working effectively with our Indigenous partners. The Privacy Policy Unit offered Personal Information Management training to all employees across the Department. The training session familiarizes employees with the personal information life cycle and the securing and safeguarding of personal information. In addition to these training sessions, the ATIP Office meets bi-annually with Liaison Officers for Town Hall sessions in order to establish open and transparent communication with our internal partners.

Ad hoc training sessions are often done by ATIP Team Leaders and the Deputy Directors with all levels of staff, including but not limited to, senior management, Deputy Minister's and Minister's offices. These sessions range from ATIP awareness sessions, informal briefings on the Acts or a topic of interest related to ATIP. One-on-one training sessions are also done with minister's offices staff, senior management and the directors and deputy directors. These types of training and awareness sessions are meant to ensure consistency with the application of the Acts and create open and transparent dialogue within the Department.

roman numeral 6. Monitoring Compliance

The ATIP Office does weekly, monthly, quarterly and ad hoc reporting on all aspects of ATIP Operations and compliance with all levels of staff. During the reporting period there were weekly meetings with Minister's Offices, Deputy Minister's Office, Parliamentary Affairs and Communications in order to present the incoming and outgoing requests. Monthly statistical reporting of ATIP Operations is completed and presented to the Corporate Secretary and to senior management, and reporting on compliance is provided quarterly to sectors. The Director of ATIP meets with sector heads on an ad hoc basis to discuss compliance. The System Administrator is responsible for all reporting functions including the time taken to process privacy requests and Operations Unit compliance.

The Privacy Policy Unit provides upon request guidance and advice to sectors in relation to the collection, use and disclosure of personal information associated to contracts, agreements and arrangements. The Privacy Policy Unit has tools available and provides guidance for the sharing of personal information under section 8(2) of the Privacy Act. Additionally, the Privacy Policy Unit provides input into program authority development to ensure privacy is considered and planned at the beginning of activities.

Highlights

roman numeral 7. 2024-2025 Points of Interest

CIRNAC received 384 new privacy requests and closed 292, with a total of 21,855 pages processed under the PA this fiscal year. The Department achieved a 86% compliance rate. There was an influx of requests over previous years due to the Federal Boarding Home Settlement.

The most cited exemption under the PA was Section 26 for personal information of other individuals.

This year, the Department received five (5) complaints or investigations from the Office of the Privacy Commissioner, closed 6 complaints and processed a total of 15,608 pages.

There were no permissible disclosure requests processed under paragraph 8(2)(m) or under subsection 8(5) of the Privacy Act, which allows for the release of personal information without consent. There were 42 permissible disclosures authorized through the ATIP Office for CIRNAC. The majority of the permissible disclosures relate to research-driven requests pursuant to section 8(2)(k) of the Privacy Act. They are primarily disclosures to Indigenous persons, representatives, or rights holders, and associated with the affirmation and implementation of the rights of Indigenous Peoples; for the negotiating of agreements; and the advancement of reconciliation.

The focus of the Privacy and Policy unit in 2024-2025 was on data sharing activities related to the disclosure of personal information associated with ongoing agreements with partner organizations and governance activities; and supporting the Department's Specific Claims record access process, through the development and provision of guidance and common templates; supporting legislative reform as it relates to personal information; and providing advice and internal privacy policy support.

The ATIP Office continues to provide privacy advice for CIRNAC's disclosure initiatives supporting the Truth and Reconciliation Commission's Calls to Action 71 to 76.

The ATIP Office has worked with and continues to work Central Agencies, partners, and stakeholders to develop and implement policies and procedures related to the disclosure of personal information to support treaty resolution activities such as shared flexible common language templates for multiple First Nation disclosure requests; development of departmental specific guidance on Privacy Notices, and have continued a comprehensive review of Personal Information Banks to support the departmental mandate for service transfer.

CIRNAC offered training to employees Access to Information Act and Privacy Act in 2024-2025. The Privacy Policy unit also provided Personal Information Management training to employees.

The ATIP office continuously monitors progress on all privacy files. Reports are prepared monthly to ensure compliance with legislative timelines so that risks can be mitigated. In addition, quarterly reports are also prepared regarding the Department's performance in meeting legislative timeframes and are shared with senior management.

For the 2024-2025 fiscal year, CIRNAC spent $234,564 to support the administration of the Privacy Act.

Annex A

Order of Delegation of the Privacy Act dated January 28, 2021

Delegation Order

Access to Information Act and Privacy Act

I, the Minister of Crown-Indigenous Relations and Northern Affairs Canada, pursuant to section 95 of the Access to Information Act and section 73 of the Privacy Act, hereby delegate the persons holding the positions set out in the Delegation of Authority Schedule attached hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Minister as head of Crown-Indigenous Relations and Northern Affairs Canada, under the provisions of the Act and related regulations set out in the schedule opposite each position. This delegation supersedes all previous delegation orders.

Original document signed on January 28 2021

The Honourable Carolyn Bennett
Minister of Crown-Indigenous Relations

Designation Pursuant to Section 73 of the Access to Information Act

6
Advise requesters that we need additional information to proceed with their request
7(a)
Give written notice to requestor that we can proceed with the request
8(1)
Transfer request to another institution or accept transfer from another institution
9
Extend time limits
10
Refuse to acknowledge or deny the existence of records
11
Charge additional fees
12
Provide access in alternate format
13
Exempt information obtained in confidence
14
Exempt information pertaining to federal-provincial affairs
15
Exempt information pertaining to international affairs and/or defence
16
Exempt information pertaining to law enforcement and investigations
17
Exempt information pertaining to the safety of individuals
18
Exempt information pertaining to the economic interests of Canada
19
Exempt personal information
20
Exempt or disclose third party information
21
Exempt information pertaining to advice, decision-making processes of government plans and positions etc.
22
Exempt information pertaining to testing procedures or audits
23
Exempt information pertaining to solicitor-client privilege
24
Exempt information subject to statutory prohibitions or other Acts of Parliament
25
Sever information
26
Exempt information to be published within 90 days
27(1)(4)
Notify third parties of their rights to provide comments/representations regarding the disclosure of their records
28
Receive third party representations; make a decision as to whether to disclose the record or part thereof; and, notify third party of right to appeal to Federal Court
29(1)
Disclose information on Information Commissioner's recommendation
33
Advise the Information Commissioner of any third-party involvement
35(2)
Make representations to the Information Commissioner during an investigation
37(4)
Release information to complainant
43(1)
Issue a notice to a third party of an application for Court review
44(2)
Issue a notice to an applicant that a third party has applied for Court review
52
Request special rules for hearings
69
Exclude Cabinet Confidences
71
Inspect and exempt information in manuals
72(1)
Prepare Annual Report to Parliament
77
Carry out responsibilities conferred to the Head of the institution by the regulations made under section 77 which are not included in the above

Delegation of Authority Schedule

Position Access to Information Act and Regulations Privacy Act and Regulations
Deputy Minister Full authority Full authority except:
sections 73.1(3), 73.1(5).
Associate Deputy Minister Full authority Full authority except:
sections 73.1(3), 73.1(5).
Corporate Secretary Full authority except:
sections 94, 96(3) or 96(5).		 Full authority
Sections 72, 73.1(3), 73.1(5).
Director, Access to Information and Privacy Full authority except:
sections 94, 96(3) or 96(5).		 Full authority, except:
Sections 72, 73.1(3), 73.1(5).
Deputy Director, Access to Information and Privacy Full authority, except:
sections 33, 37(1)(c), 37(4), 41(2), 43(2), 44(2) and 52(2)(b) and 52(3), 94, 96(3) or 96(5).		 Full authority except:
sections 8(2)(j), 8(2)(m), 8(5), 9(1), 9(4), 10, 33(2), 35(1)b), 35(4), 36(3)(b), 51(2)(b), (3), 72, 73.1(3), 73.1(5).

Please see Access to Information Act for more information on the Access to Information Act.

Designation Pursuant to Section 73 of the Privacy Act

Sections and Powers, Duties or Functions

8(2)
Disclose personal information without the consent of the individual to whom it relates
8(4)
Keep copies of requests made under 8(2)(e), keep records of information disclosed pursuant to such requests and to make those records available to Privacy Commissioner
8(5)
Notify the Privacy Commissioner in writing of disclosure under paragraph 8(2)(m)
9(1)
Retain a record of use of personal information
9(4)
Notify the Privacy Commissioner of consistent use of personal information and update index accordingly
10
Include personal information in personal information banks
11(a)
Publish annually an index of all personal information banks and their respective contents
11(b)
Publish annually an index of all personal information held by the institution which is not part of a bank
14
Respond to request for access, within statutory deadline; give access or give notice
15
Extend time limit and notify applicant
16
Where access is refused
17(2)(b)
Language of access or alternative format of access
17(3)(b)
Access to personal information in alternative format
18(2)
May refuse to disclose information contained in an exempt bank
19(1)
Shall refuse to disclose information obtained in confidence from another government
19(2)
May disclose any information referred to in 19(1) if the other government consents to the disclosure or makes the information pubic
20
May refuse to disclose information injurious to federal-provincial affairs
21
May refuse to disclose information injurious to international affairs and/or defence
22
May refuse to disclose information injurious to law enforcement and investigation
23
May refuse to disclose information injurious to security clearances
24
May refuse to disclose information collected by the Canadian Penitentiary Service, the National Parole Service or the National Parole Board
25
May refuse to disclose information injurious to which could threaten the safety of individuals
26
May refuse to disclose information about other individuals, and shall refuse to disclose such information where disclosure is prohibited under section 8
27
May refuse to disclose information subject to solicitor-client privilege
28
May refuse to disclose information relating to an individual's physical or mental health where disclosure is contrary to the best interests of the individual
31
Receive notice of investigation by the Privacy Commissioner
33(2)
Make representations to the Privacy Commissioner during an investigation
35(1)
Receive the Privacy Commissioner's report of findings of the investigation and give notice of action taken
35(4)
Give complainant access to information after 35(1)(b) notice
36(3)
Receive Privacy Commissioner's report of findings of investigation of exempt
37(3)
Receive report of Privacy Commissioner's findings after compliance investigation where the institution has not complied with sections 4 to 8
51(2)(b)
Request that matter be heard and determined in National Capital Region
51(3)
Request and be given right to make representations in section 51 hearing
72(1)
Prepare Annual Report to Parliament
77
Carry out responsibilities conferred on the Head of the institution by the regulations made under section 77 which are not included above

Delegation of Authority Schedule

Position Access to Information Act and Regulations Privacy Act and Regulations
Deputy Minister Full authority Full authority except:
sections 73.1(3), 73.1(5).
Associate Deputy Minister Full authority Full authority except:
sections 73.1(3), 73.1(5).
Corporate Secretary Full authority except:
sections 94, 96(3) or 96(5).		 Full authority
Sections 72, 73.1(3), 73.1(5).
Director, Access to Information and Privacy Full authority except:
sections 94, 96(3) or 96(5).		 Full authority, except:
Sections 72, 73.1(3), 73.1(5).
Deputy Director, Access to Information and Privacy Full authority, except:
sections 33, 37(1)(c), 37(4), 41(2), 43(2), 44(2) and 52(2)(b) and 52(3), 94, 96(3) or 96(5).		 Full authority except:
sections 8(2)(j), 8(2)(m), 8(5), 9(1), 9(4), 10, 33(2), 35(1)b), 35(4), 36(3)(b), 51(2)(b), (3), 72, 73.1(3), 73.1(5).

Please see Privacy Act for more information on the Privacy Act

Annex B

Statistical Report on the Privacy Act

Name of institution: Crown-Indigenous Relations and Northern Affairs Canada

Reporting period: 4/1/2024 to 3/31/2025

Section 1: Requests Under the Privacy Act

1.1 Number of requests
1.1.1 Number of requests
Number of requests
Received during reporting period 384
Outstanding from previous reporting periods
Outstanding from previous reporting period 6
Outstanding from more than one reporting period 1
Total Outstanding from previous reporting periods 7
Total 391
1.1.2 Number of requests
Number of requests
Closed during reporting period 292
Carried over to next reporting period
Outstanding from previous reporting period 75
Outstanding from more than one reporting period 24
Total carried over to the next reporting period 99
1.2 Channels of requests
Source Number of requests
Online 79
E-mail 303
Mail 1
In person 0
Phone 0
Fax 1
Total 384

Section 2: Informal requests

2.1 Number of informal requests
2.1.1 Number of informal requests
Number of requests
Received during reporting period 0
Outstanding from previous reporting periods
Outstanding from previous reporting period 0
Outstanding from more than one reporting period 0
Total Outstanding from previous reporting periods 0
Total 0
2.1.2 Number of informal requests
Number of requests
Closed during reporting period 0
Carried over to next reporting period 0
2.2 Channels of informal requests
Source Number of requests
Online 0
E-mail 0
Mail 0
In person 0
Phone 0
Fax 0
Total 0
2.3 Completion time of informal requests
Completion Time
0 to 15 days 16 to 30 days 31 to 60 days 61 to 120 days 121 to 180 days 181 to 365 days More than 365 days Total
0 0 0 0 0 0 0 0
2.4 Pages released informally
Less Than 100
Pages Peleased		 100-500
Pages Released		 501-1000
Pages Released		 1001-5000
Pages Released		 More Than 5000
Pages Released
Number of Requests Pages Released Number of Requests Pages Released Number of Requests Pages Released Number of Requests Pages Released Number of Requests Pages Released
0 0 0 0 0 0 0 0 0 0

Section 3: Requests Closed During the Reporting Period

3.1 Disposition and completion time
Disposition of Requests Completion Time
0 to 15 Days 16 to 30 Days 31 to 60 Days 61 to 120 Days 121 to 180 Days 181 to 365 Days More Than 365 Days Total
All disclosed 3 36 11 2 0 0 0 52
Disclosed in part 4 94 39 10 2 3 1 153
All exempted 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0
No records exist 32 19 5 0 0 0 0 56
Request abandoned 23 2 6 0 0 0 0 31
Neither confirmed nor denied 0 0 0 0 0 0 0 0
Total 62 151 61 12 2 3 1 292
3.2 Exemptions
Section Requests
26 156
27 1
27.1 1
3.3 Exclusions
Section Requests
70(1)(a) 1
3.4 Format of information released
Paper Electronic Other
E-record Data set Video Audio
1 204 0 0 0 0
3.5 Complexity
3.5.1 Relevant pages processed and disclosed for paper and e-record formats
Number of Pages Processed Number of Pages Disclosed Number of Requests
21,855 5,479 236
3.5.2 Relevant pages processed by request disposition for paper and e-record formats by size of requests
Disposition Less Than 100
Pages Processed		 100-500
Pages Processed		 501-1000
Pages Processed		 1001-5000
Pages Processed		 More Than 5000
Pages Processed
Number of Requests Pages Processed Number of Requests Pages Processed Number of Requests Pages Processed Number of Pequests Pages Processed Number of Requests Pages Processed
All disclosed 51 324 1 158 0 0 0 0 0 0
Disclosed in part 123 2633 26 5869 0 0 3 3728 1 8864
All exempted 0 0 0 0 0 0 0 0 0 0
All excluded 0 0 0 0 0 0 0 0 0 0
Request abandoned 30 137 1 142 0 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0 0 0 0 0 0
Total 204 3094 28 6169 0 0 3 3728 1 8864
3.5.3 Relevant minutes processed and disclosed for audio formats
Processed Disclosed Number of Requests
0 0 0
3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests
Disposition Less than 60 Minutes processed 60–120 Minutes processed More than 120 Minutes processed
Number of requests Minutes Processed Number of requests Minutes Processed Number of requests Minutes Processed
All disclosed 0 0 0 0 0 0
Disclosed in part 0 0 0 0 0 0
All exempted 0 0 0 0 0 0
All excluded 0 0 0 0 0 0
Request abandoned 0 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0 0
Total 0 0 0 0 0 0
3.5.5 Relevant minutes processed and disclosed for video formats
Processed Disclosed Number of Requests
0 0 0
3.5.6 Relevant minutes processed per request disposition for video formats by size of requests
Disposition Less than 60 Minutes processed 60–120 Minutes processed More than 120 Minutes processed
Number of requests Minutes Processed Number of requests Minutes Processed Number of requests Minutes Processed
All disclosed 0 0 0 0 0 0
Disclosed in part 0 0 0 0 0 0
All exempted 0 0 0 0 0 0
All excluded 0 0 0 0 0 0
Request abandoned 0 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0 0
Total 0 0 0 0 0 0
3.5.7 Other complexities
Disposition Consultation Required Legal Advice Sought Interwoven Information Other Total
All disclosed 0 0 0 0 0
Disclosed in part 0 0 3 0 3
All exempted 0 0 0 1 1
All excluded 0 0 0 0 0
Request abandoned 0 0 0 0 0
Neither confirmed nor denied 0 0 0 0 0
Total 0 0 3 1 4
3.6 Closed requests
3.6.1 Number of requests closed within legislated timelines
Number of requests closed within legislated timelines 251
Percentage of requests closed within legislated timelines (%) 85.95890411
3.7 Deemed refusals
3.7.1 Reasons for not meeting legislated timelines
Number of requests closed past the legislated timelines Principal Reason
Interference with operations / Workload External Consultation Internal Consultation Other
41 40 1 0 0
3.7.2 Request closed beyond legislated timelines (including any extension taken)
Number of days past legislated timelines Number of requests past legislated timeline where no extension was taken Number of requests past legislated timeline where an extension was taken Total
1 to 15 days 19 1 20
16 to 30 days 7 2 9
31 to 60 days 5 0 5
61 to 120 days 2 1 3
121 to 180 days 1 1 2
181 to 365 days 0 1 1
More than 365 days 0 1 1
Total 34 7 41
3.8 Requests for translation
Translation Requests Accepted Refused Total
English to French 0 0 0
French to English 0 0 0
Total 0 0 0

Section 4: Disclosures Under Subsections 8(2) and 8(5)

Paragraph 8(2)(e) Paragraph 8(2)(m) Subsection 8(5) Total
0 0 0 0

Section 5: Requests for Correction of Personal Information and Notations

5.1 Requests for Correction of Personal Information and Notations
Disposition for Correction Requests Received Number
Notations attached 0
Requests for correction accepted 0
Total 0

Section 6: Extensions

6.1 Reasons for extensions
Number of extensions taken 15(a)(i) Interference with operations 15 (a)(ii) Consultation 15(b)
Translation purposes or conversion
Further review required to determine exemptions Large volume of pages Large volume of requests Documents are difficult to obtain Cabinet Confidence Section (Section 70) External Internal
39 1 6 31 1 0 0 0 0
6.2 Length of extensions
Number of extensions taken 15(a)(i) Interference with operations 15 (a)(ii) Consultation 15(b)
Translation purposes or conversion
Further review required to determine exemptions Large volume of pages Large volume of requests Documents are difficult to obtain Cabinet Confidence Section (Section 70) External Internal
1 to 15 days 0 0 0 0 0 0 0 0
16 to 30 days 1 6 31 1 0 0 0 0
31 days or greater 0 0 0 0 0 0 0 0
Total 1 6 31 1 0 0 0 0

Section 7: Consultations Received From Other Institutions and Organizations

7.1.1 Consultations received and outstanding from other Government of Canada institutions and other organizations
Consultations Other Government of Canada Institutions Number of Pages to Review Other Organizations Number of Pages to Review
Received during the reporting period 0 0 0 0
Outstanding from the previous reporting period 0 0 0 0
Total 0 0 0 0
7.1.2 Consultations closed and carried over from other Government of Canada institutions and other organizations
Consultations Other government of Canada institutions Number of pages to review Other organizations Number of pages to review
Closed during the reporting period 0 0 0 0
Carried over within negotiated timelines 0 0 0 0
Carried over beyond negotiated timelines 0 0 0 0
Total carried over 0 0 0 0
7.2 Recommendations and completion time for consultations received from other Government of Canada institutions
Recommendation Number of Days Required to Coomplete Consultation requests
0 to 15 days 16 to 30 days 31 to 60 days 61 to 120 days 121 to 180 days 181 to 365 days More than 365 days Total
Disclose entirely 0 0 0 0 0 0 0 0
Disclose in part 0 0 0 0 0 0 0 0
Exempt entirely 0 0 0 0 0 0 0 0
Exclude entirely 0 0 0 0 0 0 0 0
Consult other institution 0 0 0 0 0 0 0 0
Other 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0
7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada
Recommendation Number of Days Required to Complete Consultation requests
0 to 15 Days 16 to 30 Days 31 to 60 Days 61 to 120 Days 121 to 180 Days 181 to 365 Days More Than 365 Days Total
Disclose entirely 0 0 0 0 0 0 0 0
Disclose in part 0 0 0 0 0 0 0 0
Exempt entirely 0 0 0 0 0 0 0 0
Exclude entirely 0 0 0 0 0 0 0 0
Consult other institution 0 0 0 0 0 0 0 0
Other 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0

Section 8: Completion Time of Consultations on Cabinet Confidences

8.1 Requests with Legal Services
Number of days Fewer Than 100 Pages Processed 100-500 Pages Processed 501-1000 Pages Processed 1001-5000 Pages Processed More than 5000 Pages Processed
Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed
1 to 15 0 0 0 0 0 0 0 0 0 0
16 to 30 0 0 0 0 0 0 0 0 0 0
31 to 60 1 5 0 0 0 0 0 0 0 0
61 to 120 0 0 0 0 0 0 0 0 0 0
121 to 180 0 0 0 0 0 0 0 0 0 0
181 to 365 0 0 0 0 0 0 0 0 0 0
More than 365 0 0 0 0 0 0 0 0 0 0
Total 1 5 0 0 0 0 0 0 0 0
8.2 Requests with Privy Council Office
Number of Days Fewer than 100 Pages Processed 100-500 Pages Processed 501-1000 Pages Processed 1001-5000 Pages Processed More than 5000 Pages Processed
Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed
1 to 15 0 0 0 0 0 0 0 0 0 0
16 to 30 0 0 0 0 0 0 0 0 0 0
31 to 60 0 0 0 0 0 0 0 0 0 0
61 to 120 0 0 0 0 0 0 0 0 0 0
121 to 180 0 0 0 0 0 0 0 0 0 0
181 to 365 0 0 0 0 0 0 0 0 0 0
More than 365 0 0 0 0 0 0 0 0 0 0
Total 0 0 0 0 0 0 0 0 0 0

Section 9: Complaints and Investigations Notices Received

Section 31 Section 33 Section 35 Court action Total
5 0 5 0 10

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

10.1 Privacy Impact Assessments
Number of PIAs completed 0
Number of PIAs modified 0
10.2 Institution-specific and Central Personal Information Banks
Personal Information Banks Active Created Terminated Modified
Institution-specific 17 0 0 0
Central 0 0 0 0
Total 17 0 0 0

Section 11: Privacy Breaches

11.1 Material Privacy Breaches reported
Number of material privacy breaches reported to TBS 0
Number of material privacy breaches reported to OPC 0
11.2 Non-Material Privacy Breaches
Number of non-material privacy breaches 3

Section 12: Resources Related to the Privacy Act

12.1 Allocated Costs
Expenditures Amount
Salaries $139,066
Overtime $954
Goods and Services
Professional services contracts $94,544
Other $0
Total Goods and Services $94,544
Total $234,564
12.2 Human Resources
12.2 Human Resources
Resources Person Years Dedicated to Privacy Activities
Full-time employees 1.494
Part-time and casual employees 0.000
Regional staff 0.000
Consultants and agency personnel 0.396
Students 0.000
Total 1.890
Note: Enter values to three decimal places.

Did you find what you were looking for?

What was wrong?

You will not receive a reply. Don't include personal information (telephone, email, SIN, financial, medical, or work details).
Maximum 300 characters

Thank you for your feedback

Date modified: