Annual Report to Parliament on the Privacy Act: 2023 to 2024

From: Canada Border Services Agency

Chapter one: Privacy Act report

Introduction

The Canada Border Services Agency (CBSA) is pleased to present to Parliament, in accordance with section 72 of the Privacy Act (PA), its annual report on the management of this Act. The report describes the activities that support compliance with the PA for the fiscal year commencing April 1, 2023, and ending March 31, 2024.

The purpose of the PA is to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and that provide individuals with a right of access to that information.^{Footnote 1}

As stated in subsections 72(1) and 72(2) of the PA, “Every year the head of every government institution shall prepare a report on the administration of this Act within the institution during the period beginning on April 1 of the preceding year and ending on March 31 of the current year… Every report prepared under subsection (1) shall be laid before each House of Parliament on any of the first 15 days on which that House is sitting after September 1 of the year in which the report is prepared.”^{Footnote 2}

Organization

1. About the Canada Border Services Agency

The CBSA has been an integral part of the Public Safety Canada portfolio since December 2003. It is responsible for protecting Canadians and maintaining a peaceful and safe society by providing integrated border services that support national security and public safety priorities and facilitate the free flow of persons and goods, including animals and plants, that meet all requirements under the program legislation.^{Footnote 3}

The CBSA carries out its responsibilities with a workforce of approximately 16,000 employees, including over 7,900 frontline CBSA officers who provide services at approximately 1,200 points across Canada and at 39 international locations.

2. Information sharing, access to information and Chief Privacy Office

In accordance with section 73 of the PA, the head of a government institution may, by order, delegate any of their powers, duties or functions under this Act to one or more officers or employees of that institution. This includes specific powers and functions to employees within the CBSA's Information Sharing, Access to Information, and Chief Privacy Office.

A copy of the Delegation Order is provided in Annex A.

Positioned within two levels of the President and with direct report to the Vice-President of the Strategic Policy Branch, the Director General of the Information Sharing, Access to Information, and Chief Privacy Office acts as the departmental Chief Privacy Officer with full delegated authority to administer and coordinate the Access to Information Act (ATIA) and the Privacy Act (PA).

The Information Sharing, Access to Information, and Chief Privacy Office's primary role is to ensure that the CBSA is compliant with the requirements of the Privacy Act, ATIA, Customs Act, Security of Canada Information Disclosure Act (SCIDA), and the Avoiding Complicity in Mistreatment by the Foreign Entities Act (ACMFEA). This includes, but is not limited to, providing functional guidance and internal services pertaining to access rights, personal information handling practices, privacy impact assessments, disclosure, and privacy breaches.

The Information Sharing, Access to Information, and Chief Privacy Office builds upon relevant government policies, regulations, and guidelines to bring agency-wide awareness on privacy principles and is the CBSA's main point of contact for the Office of the Privacy Commissioner and the Office of the Information Commissioner.

Managed by the Director General with the support of two directors, the workforce is divided into three main groups comprised of seven units: one Intake team, four Case Management units, and two Policy units.

• The Intake team receives all incoming requests and consultations, ensures quality control of all outgoing correspondence, and supports the Case Management units in their day-to-day business.
• The Case Management units assign branches and regions with retrieval requests, process requests for information under the ATIA, and provide daily operational guidance and support to CBSA employees.
• The Access to Information and Privacy (ATIP) Policy and Governance Unit develops policies, tools, and procedures to support ATIP requirements within the CBSA and provides training to employees.
• The Information Sharing and Collaborative Arrangements Policy Unit supports program-specific information sharing initiatives, and develops and maintains the CBSA's policy framework for information sharing and written collaborative arrangements.

During FY 2023 to 2024, the Information Sharing, Access to Information, and Chief Privacy Office employed approximately 101 full time equivalents and 36 part time, casual, and student employees.

To support the overall departmental compliance with the ATIA and PA, the Information Sharing, Access to Information, and Chief Privacy Office seeks advice on legal, public affairs, policy, and operational security matters from other organizations and specialists as required, and consults internally with other CBSA branches and program areas.

Having access to corporate databases and information management systems is key to maintaining compliance with the statutory time requirements of the ATIA. The Information Sharing, Access to Information, and Chief Privacy Office's ability to efficiently obtain records directly from the Global Case Management System, Field Operations Support System, Cognos, Integrated Customs Enforcement System, and the National Case Management System has allowed the CBSA to process more than 40,000 requests in-house.

Furthermore, supported by a network of ATIP liaison officers embedded within 16 offices of primary interest across the regions and branches, the Information Sharing, Access to Information, and Chief Privacy Office is optimally positioned to receive, coordinate, and process requests for information under the PA.

Lastly, to share best practices and develop streamlined processes for the retrieval of jointly held records within the 30-day legislated timeframe, the office works closely with the other agencies of the Public Safety portfolio, which include the Canadian Security Intelligence Service, the Correctional Service of Canada, the Parole Board of Canada, and the Royal Canadian Mounted Police.

Activities and accomplishments

1. Performance

On February 8, 2024, during infrastructure maintenance performed by Shared Services Canada, 40 CBSA servers were impacted. Although most servers were restored, the information contained in the ATIP servers remained inaccessible. Accordingly, Shared Services Canada and the CBSA, in collaboration with experts across the government and private sector vendors, worked together to understand the issue, its impact, and to find solutions.

At the time of the outage, there was a combined total of 16,000 on-time and late unanswered Access and Privacy requests.

Using the Treasury Board of Canada Secretariat ATIP Online Request Service, 4,000 unanswered requests were recovered, and within 10 days, the CBSA's ATIP Office returned to a full pre-outage capacity. The CBSA immediately notified the offices of the Information Commissioner and the Privacy Commissioner, and on February 21, issued the first of two media releases to inform the public about the outage, delays in processing ATIP requests electronically, and the agency's ongoing efforts to restore the affected systems. The news release also indicated that the inaccessible information has not been deleted and no security breach was identified, and encouraged requesters to continue submitting new ATIP requests through the online portal.

The CBSA continued to bolster its capacity to process requests impacted by the situation while working closely with Shared Services Canada, the Information Commissioner, and the Privacy Commissioner to ensure that the access rights of all requesters were respected.

Following an internal review of the incident, no security or privacy breaches were identified.

No requester information or records collected to respond to requests was lost; however, all the data or information was recovered in a large single package without context or framework, making it impossible to decipher which requests it corresponds to. Shared Services Canada attempted, through the use of robotics, data analytics, and artificial intelligence, to create new linkages between the requester information and the associated files; however neither department was able to connect the information to specific requests.

As a consequence, the accuracy of statistical data has been impacted. Nonetheless, the CBSA completed the statistical reports to the best of its ability using multiple data sources such as pre and post-outage records, manually documented processing data, and internal statistics recorded prior to the outage.

During FY 2023 to 2024, the CBSA continued to experience record high volumes of access to information requests. The volume is largely attributable to individuals seeking copies of their immigration file.

In November 2023, the CBSA migrated from the Immigration, Refugees and Citizenship Canada legacy platform and on-boarded to the government-wide portal for Access to Information and Privacy requests hosted by Treasury Board of Canada Secretariat, joining 260+ other federal institutions on the portal to provide increasingly single-window service to requesters.

By fiscal year end, the CBSA procured a new and modernized Access to Information and Privacy software processing tool to enable Access to Information and Privacy experts to spend more time on quality of service and less time on manipulation of documents in antiquated formats and systems.

In pursuing the modernization of its ATIP program, the CBSA continued to develop the use of Robotic Process Automation tools to enable the registration of new incoming access to information and privacy requests without the requirement for human intervention. Work on expanding the use of Robotic Process Automation tools to perform other routine processes that will create further efficiencies to enhance responsiveness to increasing volume is underway.

Lastly, pursuant to section 73.1 of the PA, the CBSA has not provided, nor received, services related to any power, duty or function conferred or imposed on the CBSA under the PA to or from another government institution that is under the responsibility of the Minister of Public Safety and Emergency Preparedness.

2. Education and training

In FY 2023 to 2024, the Information Sharing, Access to Information, and Chief Privacy Office continued to provide support and guidance to CBSA employees, adapted to numerous changes, and explore alternative measures to delivery. Specifically, the Office delivered 11 privacy sessions to 295 participants. These training sessions are designed to ensure that the participants fully understood their responsibilities under the ATIA and the PA, with a focus on requests made pursuant to the Acts and the duty to assist principles.

The Canada School of Public Service's Access to Information and Privacy Fundamentals (COR502) course also remained on the CBSA list of mandatory training. The course must be successfully completed, within six months of joining the CBSA, by all persons employed by the CBSA on a full-time, part-time, or seasonal basis and who occupy an indeterminate, term, casual, or student position.

Moreover, 28 in-person and virtual information sharing training sessions on the disclosure of personal information pursuant to section 107 of the Customs Act, section 8 of the Privacy Act, and other relevant legislation were delivered to a total of 1337 CBSA officials located in headquarters and regional offices. As a prerequisite, the CBSA also developed an information sharing introductory online course.

To raise employees' awareness of their obligations under the PA and promote ATIP tools and resources, the CBSA continued to leverage the daily newsletter to communicate important information with employees.

The CBSA, as represented by the Chief Privacy Office, holds a membership to the ATIP Community Development Office (APCDO) and is an active participant in the Treasury Board of Canada Secretariat-led ATIP coordinators, ATIP practitioners, ADM Access to information and openness committee (ATIO), and ATIP Community meetings. These meetings provide opportunities for employees of the Office to liaise with colleagues from other institutions to discuss various issues and challenges that have been identified by the ATIP community.

3. New and revised privacy-related policies and procedures

The CBSA continues to balance the right of access and program delivery with identity verification to provide an ATIP process to Canadian citizens, permanent residents, and foreign nationals. Mitigating the risk of privacy breaches while delivering government services is vital. As such, per Treasury Board of Canada Secretariat Privacy Implementation Notice 2022-02, the CBSA developed an ATIP ID Verification Policy to formalize and enhance its practices in response to the extension order, and to ensure that identity documentation is adequately verified. Additionally, the CBSA continued to revise its existing policy suite and related procedures and guidelines.

As required by the Directive on the Administration of the PA and as part of the open government initiative, the CBSA continued to post monthly summaries of completed privacy requests on the Government of Canada's mandated website^{Footnote 4}. These requests do not include personal information or any other information that would be exempted or excluded under the Act or that could reveal a requester's identity.

The CBSA also participated in the interdepartmental working group meetings led by Department of Justice in relation to the modernization of the Privacy Act. The goal of these meetings is to engage in discussions with other government departments on the evolving framework for a modernized Act, identify deficiencies or gaps in existing laws that may require legislative or regulatory reforms, and recommend updates that are in line with modern privacy practices.

4. Reading room

The CBSA, in accordance with the PA, maintains a reading room for applicants who wish to review material in person. Access to the reading room can be requested by contacting the CBSA's Information Sharing, Access to Information, and Chief Privacy Office by telephone at 343-291-7021 or email at atip-aiprp@cbsa-asfc.gc.ca. The reading room is located at:

Place Vanier Complex, 14th Floor, Tower A
333 North River Road
Ottawa, Ontario K1A 0L8

5. Audits of, and investigations into the Privacy Practices of the Canada Border Services Agency

In FY 2023 to 2024, there were no key issues raised as a result of privacy investigations, and no audits related to the CBSA's privacy practices were conducted.

6. Privacy Impact Assessments

In FY 2023 to 2024, the Information Sharing, Access to Information, and Chief Privacy Office did not complete any Privacy Impact Assessments. The CBSA continued to work closely with program areas on many initiatives that are in the process of completion in 2024, such as:

The Canada Border Services Agency (CBSA) Assessment and Revenue Management (CARM)

This project is a multi-year initiative that will transform the collection of duties and taxes for goods imported into Canada. Through CARM, the CBSA will modernize and streamline the process of importing commercial goods. Once fully implemented, CARM will:

This project is a multi-year initiative that will transform the collection of duties and taxes for goods imported into Canada. Through CARM, the CBSA will modernize and streamline the process of importing commercial goods. Once fully implemented, CARM will:

• simplify the overall importing process
• provide a modern interface for importing into Canada
• give importers self-service access to their information
• reduce the cost of importing into Canada
• improve consistency of compliance with trade rules

Preclearance

Preclearance is a border management program designed to enhance border security, improve cross-border flow of legitimate travellers and goods and allow for border infrastructure to be used more efficiently. Preclearance allows border officers of the inspecting country to determine the admissibility of travellers and goods before they enter into the territory of the inspecting country. In Canada, United States air preclearance has been in place and operating successfully since the 1950s.

Update to the Alternatives to Detention Privacy Impact Assessments

Significant funds were allocated pre-pandemic to create the Alternative to Detention program, aiming to modernize how the CBSA interacts with supervised immigrants and refugees entering Canada. The program provides the CBSA with more monitoring options, offering flexibility to agents and a humane experience for those under supervision. The Alternative to Detention Program initially included Community Case Management Supervision (CCMS), the Voice Reporting System, and Electronic Monitoring ankle bracelets. The Voice Reporting System was a pilot program to assess technology options and operational viability. It is set to expire in February 2024. the Information Sharing, Access to Information, and Chief Privacy Office continues to work with the program on a system to replace Voice Reporting System.

The full executive summaries for previous Privacy Impact Assessments completed can be found on the CBSA's website at https://www.cbsa-asfc.gc.ca/agency-agence/reports-rapports/pia-efvp/atip-aiprp/pias-sefp-eng.html.

Finally, the CBSA continued playing a critical role in ensuring that all privacy implications were considered during the development of programs and has remained committed to ongoing collaboration with the Office of the Privacy Commissioner for the development of its Privacy Impact Assessments.

Disclosures made pursuant to paragraph 8(2)(e) of the Privacy Act

During the 2023 to 2024 fiscal year, the CBSA made 164 disclosures pursuant to paragraph 8(2)(e) of the Privacy Act.

Disclosures made pursuant to paragraph 8(2)(m) of the Privacy Act

During the 2023 to 2024 fiscal year, the CBSA made one public interest disclosure pursuant to paragraph 8(2)(m) of the Privacy Act. The disclosure was to the Standing Committee on Government Operations and Estimates (the Committee) in relation to their study of the ArriveCAN and Botler AI contracts. The Office of the Privacy Commissioner was notified in advance of the CBSA's disclosure.

Delegation order

See Annex A for a signed copy of the delegation order.

Chapter two: Statistical report

Statistical Report on the Privacy Act

See Annex B for the CBSA's statistical report on the Privacy Act.

Interpretation of the statistical report

1. Requests Processed under the Privacy Act

In FY 2023 to 2024, the CBSA received 39,333 new PA requests, a 82.29% increase from the previous reporting year. This increase in numbers compared to previous fiscal year is largely due to more requests being submitted via the AORS portal as privacy requests rather than ATIA requests.

A total of 36,742 requests were completed during the 2023 to 2024 reporting period, representing a 93.41% completion rate of the total requests received during the same period.

For the past five years, the CBSA has consistently been among the top government departments and agencies in terms of the number of PA requests received. Despite the substantial number of requests received annually, the CBSA has consistently succeeded in maintaining its position as one of the top performing institutions, as evidenced by the five year trend depicted in the chart below.

Text description

Privacy requests received/completed

Fiscal year	Requests received	Completed requests
2018 to 2019	13,447	13,873
2019 to 2020	14,102	13,866
2020 to 2021	11,997	12,126
2021 to 2022	14,230	13,086
2022 to 2023	21,577	18,773
2023 to 2024	39,333	36,742

2. Completion time

As previously stated, a total of 36,742 requests were completed during FY 2023 to 2024; however due to the temporary outage in February that impacted agency data, a breakdown of completion time is only available for 26,696 of these completed requests.

The chart below presents the response times for the 26,696 requests that the CBSA completed during this fiscal year.

Text description

Response times for the requests that the CBSA completed this fiscal year (days)

Completion time (days)	Number of requests
121 or more	403
61 to 120	657
31 to 60	1,869
30 or less	23,767

Of the 26,696 completed requests, 11,128 records, representing 41.68% of requests, were fully disclosed and 8,430, representing 31.58% of requests, were partially disclosed.

The following chart provides an overview of the disposition of these completed requests. Please consult Annex B for the full details.

Text description

Disposition of completed requests

Fully disclosed	41.68%
Partially disclosed	31.58%
No records exist	2.81%
Request abandoned	23.89%
Other	0.04%

As for the 2,985 requests carried over to FY 2023 to 2024, 2,516 were on time and 469 were late.

3. Extensions

As a result of the temporary system outage in February, the CBSA was unable to retrieve the necessary data for FY 2023 to 2024. Accordingly, the number of extensions applied between April 1, 2023 and March 31, 2024 is unavailable for this reporting period.

4. Consultations received from other institutions and organizations

Per the preceding section, due to the temporary system outage in February, the CBSA was unable to retrieve the necessary data for FY 2023 to 2024. Accordingly, the number of consultations received from other institutions and organizations between April 1, 2023 and March 31, 2024 is unavailable for this reporting period.

5. Completion time of consultations on Cabinet confidences

Although Cabinet confidences are excluded from the application of the PA (section 70), Treasury Board of Canada Secretariat policies require agencies and departments to consult their legal services to determine if requested information should be excluded. In case of any doubt, or if the records contain discussion papers, legal counsel must consult the Office of the Counsel to the Clerk of the Privy Council Office (PCO).

As a result of the loss of case management data, the CBSA was unable to report the completion time of consultations on Cabinet confidences for this reporting period.

6. Complaints and investigations

Subsection 29(1) of the PA describes how the Office of the Privacy Commissioner receives and investigates complaints from individuals regarding the information held by a government institution. Examples of complaints the Office of the Privacy Commissioner may choose to investigate include refusal to disclose records, missing information, or failure to provide information in the official language requested by the individual.

Although the CBSA observed a noticeable rise in the number of privacy complaints for FY 2023 to 2024 compared to previous years, the number of complaints received constitutes only 0.26% of the total of privacy requests received.

By March 31, 2024, 87.38% of the overall total of received complaints was addressed.

Text description

Complaints received

Fiscal year	Number of complaints
2019 to 2020	2
2020 to 2021	4
2021 to 2022	11
2022 to 2023	57
2023 to 2024	103

See Annex C for details related to the number of complaints.

7. Privacy breaches

There were no material privacy breaches reported during fiscal year 2023 to 2024.

9. Conclusion

The achievements portrayed in this report reflect the CBSA's commitment to ensuring that every reasonable effort was made to meet its obligations under the PA. The CBSA strives to provide Canadians with the information to which they have a right to in a timely and helpful manner by balancing the right of access with the need to protect the integrity of the border services that support national security and public safety priorities.

Annex A: Delegation order

Annex B: Statistical report

Statistical report on the Privacy Act

Name of institution: Canada Border Services Agency

Reporting period: April 1, 2023, to March 31, 2024

Section 1: Requests under the Privacy Act

Section 2: Informal requests

Section 3: Requests closed during the reporting period

3.5 Complexity

3.6 Closed requests

3.7 Deemed refusals

Section 4: Disclosures under subsections 8(2) and 8(5)

Section 5: Requests for correction of personal information and notations

Section 6: Extensions

Section 7: Consultations received from other institutions and organizations

Section 8: Completion time of consultations on cabinet confidences

Section 9: Complaints and investigations notices received

Section 10: Privacy impact assessments (PIA) and personal information banks (PIB)

Section 11: Privacy breaches

Section 12: Resources related to the Privacy Act

Annex C: Supplemental statistical report on the Privacy Act

Statistical report on the Access to Information Act and the Privacy Act

Name of institution: Canada Border Services Agency

Reporting period: April 1, 2023, to March 31, 2024

Section 1: Open requests and complaints under the Access to Information Act

Section 2: Open requests and complaints under the Privacy Act

Section 3: Social Insurance Number (SIN)

Section 4: Universal Access under the Privacy Act