2022 to 2023 Annual report on the Privacy Act

​​​​​On this page

• Introduction and purpose of the Privacy Act
• Immigration and Refugee Board of Canada
• Communications and Access to Information Directorate
• Delegation of authority
• Statistical report on the Privacy Act – Interpretation
• Section 1: Requests under the Privacy Act
• 1.1 Number of requests received
• 1.2 Channels of requests
• Section 2: Informal requests
• 2.1 Number of informal requests
• 2.2 Channels of informal requests
• 2.3 Completion time of informal requests
• 2.4 Pages released informally
• Section 3: Requests closed during the reporting period
• 3.1 Disposition and completion time
• 3.2 Exemptions
• 3.3 Exclusions
• 3.4 Format of information released
• 3.5 Complexity
• 3.5.1 Relevant pages processed and disclosed for paper and e-records formats
• 3.5.2 Relevant pages processed by request disposition for paper and e-records formats by size of requests
• 4.5.3 Relevant minutes processed and disclosed for audio formats
• 3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests
• 3.5.5 Relevant minutes processes and disclosed for video formats
• 3.5.6 Relevant minutes processed per request disposition for video formats by size of requests
• 3.5.7 Other complexities
• 3.6 Closed requests
• 3.6.1 Requests closed within legislated timelines
• 3.7 Deemed refusals
• 3.7.1 Reasons for not meeting legislated timelines
• 3.7.2 Request closed beyond legislated timelines (including any extension taken)
• 3.8 Requests for translations
• Section 4: Disclosures under subsections 8(2) and 8(5)
• Section 5: Requests for correction of personal information and notations
• Section 6: Extensions
• 6.1 Reasons for extensions
• 6.2 Length of extensions
• Section 7: Consultations received from other institutions and organizations
• 7.1 Consultations received from other Government of Canada institutions and other organizations
• 7.2 Recommendations and completion time for consultations received from other Government of Canada institutions
• 7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada
• Section 8: Completion time of consultations on cabinet confidences
• 8.1 Requests with Legal Services
• 8.2 Requests with Privy Council Office
• Section 9: Complaints and investigations notices received
• Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)
• 10.1 Privacy Impact Assessments
• 10.2 Institution-specific and Central Personal Information Banks
• Section 11: Privacy breaches
• 11.1 Material privacy breach reports
• 11.2 Non-material privacy breach
• Section 12: Resources related to the Privacy Act
• 12.1 Allocated costs
• 12.2 Human resources
• Training and awareness
• Monitoring activities
• Education and training activities
• Policies, guidelines, procedures, and initiatives
• Privacy implementation notice
• Social Insurance Number (SIN)
• Reading Rooms
• Impact of pandemic (COVID-19)
• Appendix A - Delegation orders (Privacy Act)
• Appendix B - Statistical report on the Privacy Act
• Appendix C - Supplemental Access to Information and Privacy statistical form

​Introduction and purpose of the Privacy Act

The Privacy Act (the Act) provides Canadian citizens, permanent residents or any person present in Canada with a right of access to their personal information being held by federal government institutions, subject to specific and limited exceptions. However, and as per the Extension Order No. 3 dated July 13, 2022, all individuals now have a general right of access under the Privacy Act to their personal information that is held by federal government institutions, whether they are within or outside Canada.

Section 72(1) of the Actrequires deputy heads of all government institutions to table an annual report on the administration of the Actwithin their respective institutions during each financial year

This annual report provides a summary of the management and administration of the Actwithin the Immigration and Refugee Board of Canada (IRB) during the 2022-2023 reporting period. It is intended for use by the general public, members of Parliament, and IRB personnel.

Immigration and Refugee Board of Canada

The IRB is Canada’s largest independent administrative tribunal. It is responsible for resolving immigration and refugee cases efficiently, fairly and in accordance with the law.

The IRB is composed of four divisions:

• The Refugee Protection Division (RPD), which decides:
• claims for refugee protection made within Canada
• applications for vacation of refugee protection, and
• applications for cessation of refugee protection.
• The Immigration Division (ID), which conducts:
• admissibility hearings for foreign nationals or permanent residents who seek entry into Canada, or who are already in Canada and are alleged to be inadmissible, and
• detention reviews for foreign nationals or permanent residents who are detained for immigration reasons.
• The Immigration Appeal Division (IAD), which hears:
• appeals of family sponsorship applications refused by Immigration, Refugees and Citizenship Canada (IRCC)
• appeals from certain removal orders made against permanent residents, Convention refugees and other protected persons, and holders of permanent resident visas
• appeals by permanent residents against whom an IRCC officer outside of Canada has decided that they have not fulfilled their residency obligation, and
• appeals by the Minister of Public Safety of ID decisions at admissibility hearings.
• The Refugee Appeal Division (RAD), which hears:
• appeals from decisions of the RPD allowing or rejecting claims for refugee protection,
• appeals from decisions of the RPD rejecting applications by the Minister for a determination that refugee protection has ceased, and
• appeals from decisions of the RPD rejecting applications by the Minister to vacate a decision to allow a claim for refugee protection.

The Chairperson of the IRB reports to Parliament through the Minister of Immigration, Refugees and Citizenship Canada.

Communications and Access to Information Directorate

The Communications and Access to Information Directorate ensures that the IRB meets its statutory obligations under the Access to Information Act and the Privacy Act by:

• processing access and privacy requests made to the IRB
• responding to consultation requests submitted by other federal institutions
• providing advice and guidance to IRB personnel regarding the interpretation of both acts as well as related Treasury Board of Canada Secretariat (TBS) policies and guidelines
• liaising on behalf of the IRB with the TBS, the offices of the Information Commissioner and the Privacy Commissioner and other government departments and agencies on a wide variety of ATIP-related issues ranging from legislative interpretation to details of process and procedures
• providing input into the development of IRB policies and procedures to ensure that they comply with the provisions of both acts
• coordinating the preparation of the IRB’s Info Source chapter
• preparing the annual reports to Parliament on the administration of each act, and
• participating in ATIP forums such as the TBS’s ATIP Community meetings and working groups.

The Access to Information and Privacy (ATIP) Unit, which is within the Communications and Access to Information Directorate, is part of the Strategic Directions and Corporate Affairs Branch and includes the following positions: a manager/coordinator, a supervisor, six ATIP officers and two clerks.

Although section 73.1 of the Privacy Act allows institutions reporting to the same Minister to enter into agreements with each other for the purpose of sharing ATIP resources and capacity, the IRB did not have any such service agreement for the reporting period.

Delegation of authority

Pursuant to section 73(1) of the Privacy Act, the deputy head of a government institution may by order designate one or more officers or employees of the institution to exercise or perform any of the powers, duties or functions of the deputy head of the institution. 

Authority to exercise the powers and perform the duties and functions of the Chairperson (deputy head) of the IRB for the purposes of the Act has been delegated to the Executive Director, the Director General of the Strategic Directions and Corporate Affairs Branch, the Director of Communications and Access to Information Directorate, the ATIP Manager/Coordinator and the ATIP supervisor.

The Chairperson, the Executive Director, the Departmental Security Officer, the Deputy Departmental Security Officer and the Regional Security Officer are responsible for approving disclosures of personal information deemed to be in the public interest in accordance with paragraph 8(2)(m) of the Act.

A copy of the delegation order is enclosed at Appendix A.

Statistical report on the Privacy Act – Interpretation

The following provides an overview of the statistical information contained in Appendix B of this report.

Section 1: Requests under the Privacy Act

1.1 Number of requests received

The IRB received 1570 formal privacy requests in 2022-23, representing an 11.5 percent decrease in volume from fiscal year 2021-22, during which 1775 formal requests were submitted.

An additional 69 requests were outstanding from the previous reporting period and a total of 48 requests received in 2022-23 were carried over to fiscal year 2023-24. As of March 31, 2023, these requests were processed within the legislated timelines.

The principal highlights for the last five reporting periods are set out in the table below:

Over the last five years, the number of requests received and completed by the IRB has fluctuated from year to year. On average, 2030 requests were received, and 2035 requests were completed annually.

1.2 Channels of requests

During 2022-23, 1228 requests (78.2%) were received by email, 289 requests were received online (18.4%), 42 requests were received by fax (2.7%) and 11 requests were received by mail 0.7%).

No request was received in person or by phone.

Section 2: Informal requests

2.1 Number of informal requests

The IRB processed a total of 4 informal privacy requests during the reporting period. A total of 2 requests were received during this reporting period and 2 requests were outstanding from previous reporting period. A total of 4 were closed during 2022-23 and none were carried over into 2023-24.

2.2 Channels of informal requests

One (1) request was received via e-mail and one (1) request was received via mail.

2.3 Completion time of informal requests

Of the 4 requests processed, 4 were closed during the reporting period. Of these 4 requests, 3 were processed within 16 to 30 days and 1 was processed within 31-60 days.

2.4 Pages released informally

From the 4 informal requests that were processed, pages were released for two of them. This represents a total of 729 pages released. For the 2 other requests, no records existed.

Section 3: Requests closed during the reporting period

3.1 Disposition and completion time

The chart below summarizes the length of time required to process the 1596 requests completed in 2022-23.

This means that the IRB responded to a total of:

• 1115 requests within 15 days (69.9%)
• 426 requests within 16-30 days (26.7%)
• 45 requests within 31-60 days (2.8%)
• 5 requests within 61-120 days (0.3%)
• 4 requests within 181-365 days (0.25%)
• 1 request in more than 365 days (0.05%)

Furthermore, and regarding the disposition:

• 28.6% of requests were closed as all disclosed
• 5.1% of requests were closed as disclosed in part
• 63.7% of requests were closed as no records exist
• 1.4% of requests were closed as abandoned
• 1.2% of requests were denied

In regard to the abandoned cases, the applicants either failed to provide sufficient information to allow the IRB to find the requested documentation or failed to obtain written consent from another individual to authorize the IRB to release the personal information.

Furthermore, a total of 1016 requests (63.7 percent) could not be processed as no relevant records existed. This is because each year the IRB’s ATIP Unit receives a large volume of privacy requests from individuals in Canada who wish to obtain a letter stating that they have never applied for refugee status in order to travel to India. The Consulate General of India requires that an official letter from the IRB be attached to each application. The letter must indicate whether or not the person made a claim for refugee protection and, if they did, whether this claim was allowed, rejected, withdrawn or abandoned.

3.2 Exemptions

Section 3.2 of the statistical report outlines the exemptions that were applied in accordance with the Act. In 2022-23, the IRB relied primarily on the exemptions provided for in the following provision of the Act:

• Section 19 dealing with personal information obtained in confidence
• Section 22 dealing with law enforcement and investigations
• Section 26 dealing with personal information, and
• Section 27 dealing with patents and trademarks

It should be noted that if an exemption was applied several times within the same request, it is reported only once in the enclosed statistical report.

3.3 Exclusions

During the 2022-23 reporting period, no exclusions pursuant to sections 69 and 70 of the Act were applied by the IRB.

3.4 Format of information released

Consistent with previous reporting period, the electronic format was mostly used (91%) for the release of information. In addition, the format of information released was audio for 50 requests (8.8%) and the format of information released was paper copy in only one case (0.2%).

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper and e-records formats

A total of 246,111 pages were processed and 210,142 were released during 2022-23. To compare, approximately 74,976 more pages were processed, and 72,579 more pages were released in 2022-23 than in the previous fiscal year.

The chart below summarizes the number of pages processed and released in the last five reporting periods.

3.5.2 Relevant pages processed by request disposition for paper and e-records formats by size of requests

In 2022-23, a total of 246 requests had fewer than 100 pages processed. In addition to that, 171 had between 100-500 pages processed, 101 had between 501-1,000 pages processed, 60 had between 1,001-5,000 pages processed, and 2 had more than 5,000 pages processed.

3.5.3 Relevant minutes processed and disclosed for audio formats

Overall, 50 requests for audio were received during 2022-23 which represent a total of 8721 minutes that were processed and disclosed.

3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests

With regard to the relevant minutes processed by size of those 50 requests, we can establish the following:

• in 5 cases, less than 60 minutes were processed (total of 215 minutes)
• in 12 cases, between 60 and 120 minutes were processed (total of 1,134 minutes), and
• in 33 cases, more than 120 minutes were processed (total of 7,372 minutes)

3.5.5 Relevant minutes processes and disclosed for video formats

No request for video was received last fiscal year.

3.5.6 Relevant minutes processed per request disposition for video formats by size of requests

No request for video was received last fiscal year.

3.5.7 Other complexities

Last fiscal year, 96 requests had complexities; none required consultation, while some required legal advice (13), had interwoven information (51) or some other complexities (32).

3.6 Closed requests

3.6.1 Number of requests closed within legislated timelines

During 2022-23, 1570 requests were closed within legislated timeframe which represent 98.37%.

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines

During the 2022-23 reporting period, a total of 26 requests were closed past the legislated timeline. In 25 cases, the reason for closing past the legislated timelines was that meeting the original time limit would have unreasonably interfered with the operations of the IRB. In 1 case, another reason made it impossible to meet the initial deadline.

3.7.2 Request closed beyond legislated timelines (including any extension taken)

Of these 26 requests, 14 were processed within 15 days past legislated timelines, 3 were processed within 16-30 days past legislated timelines, 4 were processed within 31-60 days past legislated timelines, 0 were processed within 61-120 days past legislated timelines, 1 was processed within 121-180 days past legislated timelines, 3 were processed within 181-365 days past legislated timelines, and 1 was processed in more than 365 days past legislated timelines.

3.8 Requests for translations

There was no request for the translation of records from one official language to the other during the reporting period.

Section 4: Disclosures Under Subsections 8(2) and 8(5)

In 2022-23, personal information was disclosed in accordance with the following paragraphs of the Act as set out in the table below:

As shown in the above chart, most disclosures were done under paragraphs 8(2)(d) and 8(2)(e). There were some disclosures under paragraph 8(2)(a) during 2022-23. There were none under paragraphs 8(2)(m) or 8(5).

Section 5: Requests for correction of personal information and notations

No requests for correction to personal information were made during the reporting period.  

Section 6: Extensions

6.1 Reasons for extensions

Last reporting period, all extensions were taken based on interference with operations.

6.2 Length of extensions

The length of extension that was taken for all 34 extensions was for 16 to 30 days. 

Section 7: Consultations received from other institutions and organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

There was one (1) consultation received from other institutions and organizations.

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

One (1) consultation was received from another government of Canada institution. All records sought were disclosed entirely. The consultation was completed within 15 days.

7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada

There was also one (1) consultation received from another institutions or organization outside the Government of Canada. The records were disclosed in part and processing was completed within 15 days.

Section 8: Completion time of consultations on cabinet confidences

8.1 Requests with Legal Services

There was no consultation request on Cabinet Confidence with Legal Services.

8.2 Requests with Privy Council Office

There was no consultation request on Cabinet Confidence with Privy Council Office.

Section 9: Complaints and investigations notices received

In fiscal year 2022-23, the IRB processed 4 complaints. Of these 4 complaints, two new complaints were filed with the Office of the Privacy Commissioner of Canada against the IRB. Both complaints are still ongoing and have been carried over into 2023-24.

In addition, two complaints which had been received in previous reporting periods (1 in 2019–20 and 1 in 2020–21) were processed last fiscal year. Of these 2 complaints, none were closed during reporting period and have been carried over into 2023-24. These 4 complaints represent 0.3% of all requests received during 2022-23, including those outstanding from previous reporting periods.

No audits were conducted during 2022–23.

Actions that were taken by the IRB during the reporting period to resolve privacy complaints were conducting new searches to validate if any records existed and which would not have been provided when initially processing the requests.

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

10.1 Privacy Impact Assessments

During 2022-23, no Privacy Impact Assessments were completed or modified.

10.2 Institution-specific and central Personal Information Banks

The IRB has seven active Personal Information Banks; however, the Board did not create or modify any Personal Information Banks in 2022-23.

Section 11: Privacy breaches

11.1 Material privacy breach reports

One material privacy breach was reported during 2022-23. As the risk was deemed high, the Board informed both the Office of the Privacy Commissioner of Canada and the TBS.

11.2 Non-material privacy breach

During the reporting period, the IRB identified 109 new cases of non-material privacy breaches. In addition, 21cases of non-material privacy breaches were outstanding from 2021-22. All these 130 actives cases are currently being reviewed and have been carried over into 2023-24. The Board did not inform the Office of the Privacy Commissioner of Canada because the risk was deemed low and the information was quickly contained.

Section 12: Resources related to the Privacy Act

12.1 Allocated costs

In 2023-23, the total costs incurred by the Communications and Access to Information Directorate for the administration of the Act is estimated to be $516,933, all in salaries.

The chart below shows the expenditures’ breakdown for 2022-23:

12.2 Human Resources

The employee resources for this reporting period are estimated at 5 FTEs.

Training and awareness

Monitoring activities

The manager, in cooperation with the supervisor and analysts, monitors the processing times for privacy requests, on a weekly basis. In addition, ATIP staff periodically perform diagnostic activities related to the processing of the various requests received.

Education and training activities

No formal session was delivered to IRB employees.  However, individual and informal training was offered when needed.

Policies, guidelines, procedures, and initiatives

Privacy implementation notice

The IRB continues to implement the Privacy Implementation Notice 2020-03: Protecting privacy when releasing information about a small number of individuals during the 2022–23 reporting period, to prevent inadvertent identification of individuals from small data sets in highly sensitive contexts (e.g. refugee claims).

Social Insurance Number (SIN)

The IRB did not receive authority for a new collection or new consistent use of the SIN in 2022–2023.

Reading rooms

Individuals who wish to examine records released under the Act can contact the Communications and Access to Information Directorate to make arrangements to view release packages at the IRB Headquarters in Ottawa or at one of its regional offices. However, given the exceptional measures to curb COVID-19 implemented by the Government of Canada, it has not been possible to do so in 2022-23.

Impact of pandemic (COVID-19)

In fiscal year 2022-23, the pandemic had no impact on the IRB’s ability to receive requests as set out in the Privacy Act. No procedural challenges were observed while employees were working from home. Teleworking was already in place in the ATIP Unit before the pandemic and has continued since.

Appendix A - Delegation orders (Privacy Act)

The Chairperson of the Immigration and Refugee Board of Canada, pursuant to section 73(1) of the Privacy Act^{Footnote 1}, hereby designates the persons holding the positions set out in the schedule below, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Chairperson as the head of the Immigration and Refugee Board of Canada, under the provisions of the Act and related regulations set out in the Schedule opposite each position. This designation replaces all previous delegation orders.

Dated, at the City of Ottawa, this 12 day of January 2021.

Richard Wex,
Chairperson

Appendix B - Statistical report on the Privacy Act

Section 1: Requests under the Privacy Act

Section 2: Informal requests

Section 3: Requests closed during the reporting period

3.5 Complexity

3.6 Closed requests

3.7 Deemed refusals

Section 4: Disclosures under subsections 8(2) and 8(5)

Section 5: Requests for correction of personal information and notations

Section 6: Extensions

Section 7: Consultations received from othe institutions and organizations

Section 8: Completion time of consultations on cabinet confidences

Section 9: Complaints and investigations notices received

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

Section 11: Privacy breaches

Section 12: Resources related to the Privacy Act

Appendix C - Supplemental Access to Information and Privacy statistical form

Section 1: Capacity to receive requests under the Access to Information Act and the Privacy Act

Section 2: Capacity to process records under the Access to Information Act and the Privacy Act

Section 3: Open requests and complaints under the Access to Information Act

Section 4: open requests and complaints under the Privacy Act

Section 5: Social Insurance Number (SIN)

Section 6: Universal Access under the Privacy Act