Annual Report to Parliament on the Privacy Act
Canada Border Services Agency 2017-2018

This document is also available in PDF (1.5 Mb) [help with PDF files]

Table of Contents

• Chapter One: Privacy Act Report
  • Introduction
  • Organization
    • I. About the Canada Border Services Agency
    • II. Access to Information and Privacy Division
  • Activities and Accomplishments
    • I. Performance
    • II. Education and Training
    • III. New and Revised Privacy-related Policies and Procedures
    • IV. Reading Room
    • V. Audits of and investigations into the privacy practices of the Canada Border Services Agency
    • VI. Privacy Impact Assessments
  • Disclosures Made Pursuant to Paragraph 8(2)(e) of the Privacy Act
  • Disclosures Made Pursuant to Paragraph 8(2)(m) of the Privacy Act
  • Delegation Order
• Chapter Two: Statistical report
  • Statistical report on the Privacy Act
  • Interpretation of the Statistical Report
    • I. Requests processed under the Privacy Act
    • II. Outstanding Requests from Previous Years
    • III. Completion Time
    • IV. Complaints and Investigations
    • V. Privacy Breaches
    • VI. Conclusion
• Annex A - Delegation Order
• Annex B – Statistical Report on the Privacy Act

Chapter One: Privacy Act Report

Introduction

The Canada Border Services Agency (CBSA) is pleased to present to Parliament, in accordance with section 72 of the Privacy Act, its annual report on the management of this Act. The report describes the activities that support compliance with the Privacy Act for the fiscal year commencing April 1, 2017, and ending March 31, 2018. During this period, the CBSA continued to build on successful practices implemented in previous years.

The purpose of this Act is to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and that provide individuals with a right of access to that information.^{Footnote 1}

As stated in subsections 72(1) and 72(2) of the Privacy Act, “The head of every government institution shall prepare for submission to Parliament an annual report on the administration of this Act within the institution during each financial year.… Every report prepared under subsection (1) shall be laid before each House of Parliament within three months after the financial year in respect of which it is made or, if that House is not then sitting, on any of the first fifteen days next thereafter that it is sitting.”^{Footnote 2}

Organization

I. About the Canada Border Services Agency

Since 2003, the CBSA has been an integral part of the Public Safety Canada (PS) portfolio, which was created to ensure coordination across all federal departments and agencies responsible for national security and the safety of Canadians.^{Footnote 3} The CBSA itself is responsible for providing integrated border services that support national security and public safety priorities and facilitate the free flow of persons and goods, including animals and plants, that meet all requirements under the program legislation.

The CBSA carries out its responsibilities with a workforce of approximately 14,000 employees, including over 7,000 uniformed CBSA officers who provide services at approximately 1,100 points across Canada and at 36 international locations.

II. Access to Information and Privacy Division

The Access to Information and Privacy (ATIP) Division is comprised of six units: an Administration section, three Case Management units, and two Policy units. The Administration section’s function is to receive all incoming requests and consultations, to ensure quality control of all outgoing correspondence, and to support the Case Management units in their day-to-day business. The Case Management units assign branches and regions with retrieval requests, process requests under the Privacy Act, and provide daily operational guidance and support to CBSA employees. The ATIP Policy and Governance Unit develops policies, tools, and procedures to support ATIP requirements within the CBSA and provides training to employees. The Information Sharing and Collaborative Arrangement Policy Unit maintains the policy framework for the CBSA’s information sharing and domestic written collaborative arrangements. On average, 60 full-time equivalents, and seven part time and casual employees were employed in the ATIP Division during fiscal year 2017–2018.

The ATIP coordinator for the CBSA is the Director of the ATIP Division. The ATIP Division is part of the Corporate Secretariat, which reports to the Vice-President (VP) of the Corporate Affairs Branch. Consistent with best practices identified by the Treasury Board of Canada Secretariat (TBS),^{Footnote 4} the CBSA's ATIP coordinator is positioned within three levels of the President and has full delegated authority, reporting directly to the Director General of the Corporate Secretariat, who in turn reports to the VP of the Corporate Affairs Branch.

Key to maintaining compliance with the statutory time requirements of the Privacy Act is the ATIP Division’s ability to obtain personal information from branches and regions in a timely and reliable manner. Supported by a network of 17 ATIP liaison officers across the CBSA, the ATIP Division is well positioned to receive, coordinate, and process requests for personal information under the Privacy Act.

The ATIP Division works closely with other members of the PS portfolio, including the Canadian Security Intelligence Service, the Correctional Service of Canada, the Parole Board of Canada, and the Royal Canadian Mounted Police, to share best practices and develop streamlined processes for the retrieval of jointly held records within the 30-day legislated time frame required to respond to privacy requests.

Activities and Accomplishments

I. Performance

Fiscal year 2017–2018 saw record high volumes of privacy requests made to the CBSA. The record volumes are largely attributable to individuals seeking copies of their history of arrival dates into Canada. In fiscal year 2017–2018, 80% of all the privacy requests received by the CBSA came from individuals seeking their Traveller History Report, which contains information used to support residency requirements for programs administered by Immigration, Refugees and Citizenship Canada (IRCC) and Employment and Social Development Canada (ESDC).

The CBSA continued to see high volumes of privacy requests submitted through the Access to Information and Privacy Online Request tool. Through this tool, the Agency received 8,898 requests, which amounted to 66.3% of all privacy requests received by the CBSA.

The CBSA continued to offer the electronic format for responses to privacy requests. Although electronic format made up only 11.1% of all formal privacy requests that were either all disclosed or disclosed in part in fiscal year 2017–2018, these requests accounted for 88.1% of all the pages the CBSA disclosed in their entirety or disclosed in part this fiscal year.

The ATIP Division also provided case-by-case policy guidance to CBSA program areas related to the disclosure of information under section 8 of the Privacy Act and section 107 of the Customs Act. In total, the ATIP Division received 1,592 requests for guidance in fiscal year 2017–2018, representing an increase of 18.8% over the previous year.

II. Education and Training

In fiscal year 2017–2018, the ATIP Division continued to conduct bilingual training sessions that supported the implementation of streamlined processing procedures and built an awareness of ATIP obligations. These sessions are designed to ensure that the participants fully understand their responsibilities under the Privacy Act, with a focus on requests made pursuant to the Act and the duty to assist principles. Fifteen sessions were offered, with 204 National Capital Region (NCR) and regional employees taking part.

CBSA employees also took advantage of the free online course entitled “Managing Information at the Canada Border Services Agency and the Access to Information Act and the Privacy Act.” This one-hour online course was designed to provide employees with the basic principles for effectively managing information in their daily work. After completing this course, employees will have acquired the knowledge to better identify various types of information, learned how requests under the Access to Information Act and the Privacy Act are handled, and learned about their responsibilities throughout the process. A total of 689 participants completed the online training in fiscal year 2017–2018.

Moreover, the ATIP Division delivered 11 in-class training sessions on section 107 of the Customs Act, as well as basic information sharing, disclosure of intelligence-related information, and business line specific training sessions to 238 employees in the NCR and across the regions. In addition, before attending the in-class training, employees are advised to complete the interactive online training course, regarding information sharing that was developed by the ATIP Division.

Further, the ATIP Division developed a communications plan to raise employees’ awareness of their obligations under the Privacy Act. The plan leverages key dates, such as Data Privacy Day, and other activities at the CBSA to promote ATIP tools, resources, and awareness.

Finally, the ATIP Division continues to actively participate in the TBS-led ATIP coordinators’ and ATIP practitioners’ meetings. These meetings provide opportunities for ATIP employees from the CBSA to liaise with employees from other institutions to discuss various issues and challenges that have been identified by the ATIP community.

III. New and Revised Privacy-related Policies and Procedures

During fiscal year 2017–2018, the CBSA continued to revise existing policies and to develop new ones.

The ATIP Division has taken a number of measures to enhance and promote ATIP tools that are readily accessible to CBSA employees by utilizing Apollo (GCDocs). To this end, we are able to ensure that the ATIP intranet site is up to date and available to all CBSA employees. This allows the ATIP Division to quickly share information and best practices and to facilitate collaboration across the Agency.

During the reporting period, the Policy and Governance Unit developed an ATIP Handbook. This handbook is designed to help ATIP employees in their day to day work. It includes reference material and provides clear guidance on CBSA policy and procedures which can be easily referenced. The first issue of the Handbook focused on the Administrative section of the ATIP Division. The second issue, currently underway, will focus on the day to day work of the Case Management units. The Handbook will remain an evergreen document subject to updates and revisions.

Additionally, the policies and procedures surrounding the processing of privacy breaches were reviewed and updated. This includes a new tool to determine the severity of the breach as well as reporting procedures and reference material.

The CBSA has also been participating in the Department of Justice working groups looking at updating the Privacy Act. Some of the factors that are being examined by the Privacy Act Renewal working groups are the changes to the Privacy landscape over the years, including Canadian jurisprudence, best internationals practices, technology, the pace of technological changes, and today’s operational realities. The CBSA will continue to participate in the Privacy Act Renewal working groups.

The ATIP Division continued to provide the service of informally reviewing CBSA records for internal programs as if they had been requested under the Privacy Act. The ATIP Division received 84 internal requests of this nature in fiscal year 2017–2018.

The ATIP Division closely monitors the time it takes to process privacy requests. Monthly reports, which show trends and performance, are submitted to the managers of the Case Management units, the Director of the ATIP Division, and the Director General of the Corporate Secretariat. Monthly reports consisting of statistics on the performance of the offices of primary interest are also distributed to all ATIP liaison officers. Finally, quarterly trend reports portraying the overall performance of the Agency are reviewed and discussed during meetings of the Agency’s Executive Committee^{Footnote 5} and are included in the Agency Performance Summary.

IV. Reading Room

The CBSA, in accordance with the Privacy Act, maintains a reading room for applicants who wish to review material in person at the CBSA. Applicants may access the reading room by contacting the CBSA's ATIP Director by telephone at 343-291-7021 or by sending an email to ATIP-AIPRP@cbsa-asfc.gc.ca. The reading room is located at:

Place Vanier Complex, 14th Floor, Tower A
333 North River Road
Ottawa, Ontario K1A 0L8

V. Audits of, and Investigations into the Privacy Practices of the Canada Border Services Agency

In 2017–2018, the CBSA underwent an audit by the Office of the Privacy Commissioner of Canada (OPC) concerning the national security reporting activities at the National Targeting Centre. The audit was completed in the fall of 2017 and the recommendations are as follows:

VI. Privacy Impact Assessments

In fiscal year 2017–2018, the CBSA completed four Privacy Impact Assessments (PIA). They were all sent to the OPC and TBS for review and comments.

The four PIAs completed by the CBSA are:

• Enhanced Driver’s Licence / Enhanced Identification Card
• Asia-Pacific Economic Cooperation Business Travel Card
• CBSA-CISC Information Sharing Framework; and
• Wireless Handheld Initiative (Mobile IPIL).

The full executive summaries of these PIAs can be found on the CBSA's website.

Enhanced Driver’s License / Enhanced Identification Card

This is an addendum to the PIA submitted in December 2008 entitled Enhanced Driver's License (EDL) and Enhanced Identification Card Program – Use of EDL data by the CBSA, which is a collaborative program between the CBSA and three participating provinces: Ontario, Manitoba, and British Columbia. These provinces earlier agreed to make available enhanced documents (such as a Driver's License or an Identification Card) that meets the requirements of the Western Hemisphere Travel Initiative, allowing Canadian citizens to use the identification to facilitate land or water travel between Canada and the United States (U.S.).

Personal information is collected by the provinces and provided to the CBSA to enable query access by U.S. Customs and Border Protection in the event that a Canadian presents their card as identification at a land/water POE. The CBSA has undertaken the policy and technology work to permit Border Services Officers (BSO) to have access to the CBSA's EDL database and equipped select POEs with Radio Frequency Identification (RFID) abilities to read the card. POEs that are not RFID-enabled will still be able to scan/swipe the cards and access the CBSA database.

Asia-Pacific Economic Cooperation Business Travel Card

The Asia-Pacific Economic Cooperation (APEC) Business Travel Card (ABTC) scheme was created in the late 1990s to respond to demands of the regional business community for simpler short-term entry procedures within APEC. For fully participating economies, the ABTC provides frequent business travellers with visa-free travel, multiple short-term entries into participating APEC economies, and expedited airport processing.

The ABTC scheme is comprised of 19 fully participating countries or economies: Australia, Brunei Darussalam, Chile, China, Hong Kong, Indonesia, Japan, South Korea, Malaysia, Mexico, New Zealand, Papua New Guinea, Peru, the Philippines, Russia, Singapore, Chinese Taipei, Thailand, and Vietnam. Canada and the U.S. are considered transitional members.

For the domestic pilot project, the CBSA obtains consent from applicants and members for collecting, using, and sharing of customs/personal information pursuant to the Certification and Consent Statement in the application package that an applicant will need to agree to before proceeding with the application, as well as a Privacy Statement in the application package that explains the authorities for the collection, use, and disclosure of personal information. It also includes an attestation that the applicant is a bona fide business person.

CBSA – CISC Information Sharing Framework

The primary function of the Criminal Intelligence Service of Canada (CISC) is to facilitate the timely production and exchange of criminal intelligence information to the law enforcement community at the municipal, provincial, and federal levels. Police agencies use the information stored in a criminal intelligence databank to support the detection, prevention, and disruption of serious and organized crime in Canada.

Through a partnership with CISC, the CBSA will disclose publicly available court records related to customs and immigration offences into CISC’s criminal intelligence data bank when there are reasonable grounds to believe the offence has a nexus to serious or organized crime. Police partners will be able to search this information to support specific lawful investigations. Partners may also request additional information related to the publicly available court records through the standard written request process detailed in both the Privacy Act and the Customs Act.

The CBSA’s investigative bodies will collect personal information uploaded into the data bank to support ongoing lawful investigations of customs and immigration-related offences with a nexus to serious and organized crime.

Wireless Handheld Initiative (Mobile IPIL)

Wireless handheld devices will be introduced to support the Entry/Exit Initiative and Beyond the Border Action Plan. The devices will be equipped with a mobile version of the Integrated Primary Inspection Line application to facilitate the secure and accurate capture and risk assessment of individual traveller and conveyance information. The devices will be deployed at CBSA service points which are not equipped with primary inspection booths.

The introduction of handheld devices during primary processing will allow a Border Services Officer (BSO) to capture and risk assess conveyance and traveller information while remaining with the traveller, just as they would today if they were working at a site with primary inspection booths.

While the mobile device introduces a new means for capturing traveller and conveyance information, the type of data collected remains unchanged. The handheld is a tool used by the BSO to collect information directly from the traveller and verify it against information that is already held within CBSA information holdings.

Disclosures Made Pursuant to Paragraph 8(2)(e) of the Privacy Act

During the 2017–2018 fiscal year, 848 disclosures pursuant to paragraph 8(2)(e) of the Privacy Act were made by the CBSA.

Disclosures Made Pursuant to Paragraph 8(2)(m) of the Privacy Act

During the 2017–2018 fiscal year, the CBSA made one disclosure related to immigration removals pursuant to paragraph 8(2)(m) of the Privacy Act.

It is in the public interest to demonstrate that the CBSA is carrying out its mandate. This disclosure served to demonstrate that the objectives and integrity of the immigration system and the protection of the health and safety of Canadians were being maintained. The balance between the public’s need to know and protection of an individual’s privacy is of utmost concern to the CBSA. In this case, it was determined that public interest in the disclosure of this individual’s removal status outweighed any injury to the individual.

The OPC was notified before the disclosure was made.

Delegation Order

See Annex A for a signed copy of the delegation order.

Chapter Two: Statistical Report

Statistical report on the Privacy Act

See Annex B for the CBSA's statistical report on the Privacy Act.

Interpretation of the Statistical Report

I. Requests Processed Under the Privacy Act

The CBSA received 13,429 privacy requests in fiscal year 2017–2018, which was an increase of 15.9% over the previous year. Moreover, the CBSA responded to 13,575 Privacy Act requests, representing 89.7% of the total number of requests received and outstanding from the previous reporting period.

For the past five years, the CBSA has consistently been among the top government departments in terms of workload. While receiving a substantial number of requests each year, the CBSA has been able to maintain and improve upon its performance in a year which has seen its greatest number of requests ever received.

II. Outstanding Requests from Previous Years

During this reporting period, the CBSA built on the positive steps taken last year and was able to close more files than it received. Of the 1,555 requests carried over to fiscal year 2018–2019, 1,384 were on time and 171 were late.

III. Completion Time

Of all the requests completed, the CBSA was successful in responding to 90.8% within the legislated timelines, an increase from the 89.7% achieved last fiscal year.

In total, 1,503 extensions were applied for in fiscal year 2017–2018. This represents an increase of 65% in extensions in comparison to the previous fiscal year. This in reflective of the increased volume of requests received, which has made it more challenging for the Agency to process files within the 30 day legislated time frame.

IV. Complaints and Investigations

Subsection 29(1) of the Privacy Act describes how the OPC receives and investigates complaints from individuals regarding their personal information held by a government institution. Examples of complaints the OPC may choose to investigate include a refusal of access to personal information; an allegation that personal information about an individual that is held by a government institution has been misused or wrongfully disclosed; or failure to provide access to personal information in the official language requested by the individual.

Throughout fiscal year 2017–2018, 35 Privacy Act complaints were filed against the CBSA, which represents a decrease of 53% compared to fiscal year 2016–2017. This marks the second year in a row that the number of complaints received decreased substantially. The reason most cited for complaints was a delay in responding to requests. The complaints received during the fiscal year were related to the following issues: time delay (16); refusal to disclose (9); application of exemptions (8); collection (1); and miscellaneous (1). For context, the number of complaints filed relate to only 0.24% of the 13,575 privacy requests completed during this period.

Of the 40 complaints resolved in fiscal year 2017–2018, 35 were deemed well-founded, two were deemed not well-founded, two were settled, and one was discontinued. Where complaints are substantiated, the matter is reviewed by the delegated managers and processes are adjusted if required.

V. Privacy Breaches

One material privacy breach was reported during the 2017–2018 fiscal year. The breach involved unauthorized disclosure of information by an employee of the CBSA to two individuals outside of the Agency. The CBSA holds its employees to a high standard and expects them to carry out their duties with respect, integrity and professionalism. In this case, the matter was investigated and the employee’s network access was revoked.

VI. Conclusion

The achievements portrayed in this report reflect the CBSA’s commitment to ensuring that every reasonable effort is made to meet its obligations under the Privacy Act. The CBSA strives to provide Canadians with their personal information to which they have a right in a timely and helpful manner while protecting the privacy rights of all Canadians.

Annex A – Delegation Order

Ministerial Order
Access to Information Act & Privacy Act (ATIP)

Pursuant to section 73 of the Access to Information Act and section 73 of the Privacy Act, I hereby designate the persons holding the positions set out in the schedule hereto, or a person authorized to exercise the powers or perform the duties and functions of that position, to exercise or perform the powers, duties and functions of the Minister of Public Safety and Emergency Preparedness as the head of the Canada Border Services Agency under the provisions of the Act and related regulations set out in the schedule opposite each position.

This order replaces previous designation orders and comes into force on the date on which it is signed.

Dated at Ottawa, Province of Ontario, this 15th day of February, 2017.

The Honourable Ralph Goodale, P.C., M.P.
Minister of Public Safety and Emergency Preparedness

Annex B – Statistical Report on the Privacy Act

Name of instituation: Canada Border Services Agency

Reporting period: 2017-04-01 to 2018-03-31

Part 1 — Requests Under the Privacy Act

Part 2 — Requests Closed During the Reporting Period

2.5 Complexity

2.6 Deemed refusals

Part 3 — Disclosures Under Subsection 8(2) and 8(5)

Part 4 — Requests for Correction of Personal Information and Notations

Part 5 — Extensions

Part 6 — Consultations Received From Other Institutions and Organizations

Part 7 — Completion time of consultations on Cabinet confidences

Part 8 - Complaints and Investigations Notices Received

Part 9 - Privacy Impact Assessments (PIAs)

Part 10 — Resources related to the Privacy Act

Date modified:

2018-08-24