2023 to 2024 Annual report on the Privacy Act

On this page

• Introduction and purpose of the Privacy Act
• Immigration and Refugee Board of Canada
• Communications and Access to Information Directorate
• Delegation of authority
• Statistical report on the Privacy Act – Interpretation
• Section 1A: Requests under the Privacy Act
• 1.1 Number of requests received
• 1.2 Channels of requests
• Section 1B: Active Requests under the Privacy Act
• 1.3 Number of requests broken down by fiscal year received
• Section 2: Informal requests
• 2.1 Number of informal requests
• 2.2 Channels of informal requests
• 2.3 Completion time of informal requests
• 2.4 Pages released informally
• Section 3: Requests closed during the reporting period
• 3.1 Disposition and completion time
• 3.2 Exemptions
• 3.3 Exclusions
• 3.4 Format of information released
• 3.5 Complexity
• 3.5.1 Relevant pages processed and disclosed for paper and e-records formats
• 3.5.2 Relevant pages processed by request disposition for paper and e-records formats by size of requests
• 4.5.3 Relevant minutes processed and disclosed for audio formats
• 3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests
• 3.5.5 Relevant minutes processes and disclosed for video formats
• 3.5.6 Relevant minutes processed per request disposition for video formats by size of requests
• 3.5.7 Other complexities
• 3.6 Closed requests
• 3.6.1 Requests closed within legislated timelines
• 3.7 Deemed refusals
• 3.7.1 Reasons for not meeting legislated timelines
• 3.7.2 Request closed beyond legislated timelines (including any extension taken)
• 3.8 Requests for translations
• Section 4: Disclosures under subsections 8(2) and 8(5)
• Section 5: Requests for correction of personal information and notations
• Section 6: Extensions
• 6.1 Reasons for extensions
• 6.2 Length of extensions
• Section 7: Consultations received from other institutions and organizations
• 7.1 Consultations received from other Government of Canada institutions and other organizations
• 7.2 Recommendations and completion time for consultations received from other Government of Canada institutions
• 7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada
• Section 8: Completion time of consultations on cabinet confidences
• 8.1 Requests with Legal Services
• 8.2 Requests with Privy Council Office
• Section 9: Complaints and investigations notices received
• Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)
• 10.1 Privacy Impact Assessments
• 10.2 Institution-specific and Central Personal Information Banks
• Section 11: Privacy breaches
• 11.1 Material privacy breach reports
• 11.2 Non-material privacy breach
• Section 12: Resources related to the Privacy Act
• 12.1 Allocated costs
• 12.2 Human resources
• Training and awareness
• Monitoring activities
• Education and training activities
• Policies, guidelines, procedures, and initiatives
• Privacy implementation notice
• Social Insurance Number (SIN)
• Appendix A - Delegation orders (Privacy Act)
• Appendix B - Statistical report on the Privacy Act
• Appendix C - Supplemental Access to Information and Privacy statistical form

Introduction and purpose of the Privacy Act

The Privacy Act (the Act)provides Canadian citizens, permanent residents or any person present in Canada with a right of access to their personal information being held by federal government institutions, subject to specific and limited exceptions. However, and as per the Extension Order No. 3 dated July 13, 2022, all individuals now have a general right of access under the Act  to their personal information that is held by federal government institutions, whether they are within or outside Canada.

Section 72(1) of the Actrequires deputy heads of all government institutions to table an annual report on the administration of the Actwithin their respective institutions during each financial year.

This annual report provides a summary of the management and administration of the Actwithin the Immigration and Refugee Board of Canada (IRB) during the 2023-2024 reporting period. It is intended for use by the general public, members of Parliament, and IRB personnel.

Immigration and Refugee Board of Canada

The IRB is Canada’s largest independent administrative tribunal. It is responsible for resolving immigration and refugee cases efficiently, fairly and in accordance with the law.

The IRB is composed of four divisions:

• The Refugee Protection Division (RPD), which decides:
• claims for refugee protection made within Canada;
• applications for vacation of refugee protection; and
• applications for cessation of refugee protection.
• The Immigration Division (ID), which conducts:
• admissibility hearings for foreign nationals or permanent residents who seek entry into Canada, or who are already in Canada and are alleged to be inadmissible; and
• detention reviews for foreign nationals or permanent residents who are detained for immigration reasons.
• The Immigration Appeal Division (IAD), which hears:
• appeals of family sponsorship applications refused by Immigration, Refugees and Citizenship Canada (IRCC);
• appeals from certain removal orders made against permanent residents, Convention refugees and other protected persons, and holders of permanent resident visas;
• appeals by permanent residents against whom an IRCC officer outside of Canada has decided that they have not fulfilled their residency obligation; and
• appeals by the Minister of Public Safety of ID decisions at admissibility hearings.
• The Refugee Appeal Division (RAD) which hears:
  • appeals from decisions of the RPD allowing or rejecting claims for refugee protection;
  • appeals from decisions of the RPD rejecting applications by the Minister for a determination that refugee protection has ceased; and
  • appeals from decisions of the RPD rejecting applications by the Minister to vacate a decision to allow a claim for refugee protection.

The Chairperson of the IRB reports to Parliament through the Minister of Immigration, Refugees and Citizenship Canada.

The institution did not have any non-operational (“paper”) subsidiaries during this reporting period.

Communications and Access to Information Directorate

The Communications and Access to Information Directorate ensures that the IRB meets its statutory obligations under the Access to Information Act and the Privacy Act by:

• processing access and privacy requests made to the IRB;
• responding to consultation requests submitted by other federal institutions;
• providing advice and guidance to IRB personnel regarding the interpretation of both acts as well as related Treasury Board of Canada Secretariat (TBS) policies and guidelines;
• liaising on behalf of the IRB with the TBS, the offices of the Information Commissioner and the Privacy Commissioner and other government departments and agencies on a wide variety of ATIP-related issues ranging from legislative interpretation to details of process and procedures;
• providing input into the development of IRB policies and procedures to ensure that they comply with the provisions of both acts;
• coordinating the preparation of the IRB’s Info Source chapter;
• preparing the annual reports to Parliament on the administration of each act; and
• participating in ATIP forums such as the TBS-led ATIP Community meetings and working groups.

The Access to Information and Privacy (ATIP) Unit, which is within the Communications and Access to Information Directorate is part of the Strategic Directions and Corporate Affairs Branch and includes the following positions: a manager/coordinator, a supervisor, four ATIP officers and two clerks. At year end, six consultants were also hired on a temporary basis to expedite processing of voluminous requests.

Although section 73.1 of the Privacy Act allows institutions reporting to the same Minister to enter into agreements with each other for the purpose of sharing ATIP resources and capacity, the IRB did not have any such service agreement for the reporting period.

Delegation of authority

Pursuant to section 73(1) of the Privacy Act, the deputy head of a government institution may by order designate one or more officers or employees of the institution to exercise or perform any of the powers, duties or functions of the deputy head of the institution. 

Authority to exercise the powers and perform the duties and functions of the Chairperson (deputy head) of the IRB for the purposes of the Act has been delegated to the Executive Director, the Director General of the Strategic Directions and Corporate Affairs Branch, the Director of Communications and Access to Information Directorate, the ATIP Manager/Coordinator and the ATIP supervisor.

The Chairperson, the Executive Director, the Departmental Security Officer, the Deputy Departmental Security Officer and the Regional Security Officer are responsible for approving disclosures of personal information deemed to be in the public interest in accordance with paragraph 8(2)(m) of the Act. 

A copy of the delegation order is enclosed at Appendix A.

Statistical report on the Privacy Act – Interpretation

The following provides an overview of the statistical information contained in Appendix B of this report.

Section 1A: Requests under the Privacy Act

1.1 Number of requests received

The IRB received 1,224 formal privacy requests in 2023-24, representing a 21.8 percent decrease in volume from fiscal year 2022-23, during which 1,570 formal requests were submitted.

The principal highlights for the last five reporting periods are set out in the table below:

Over the last five years, the number of requests received and completed by the IRB has fluctuated from year to year. On average, 1,600 requests were received, and 1,646 requests were completed annually.

1.2 Channels of requests

During 2023-24, 850 requests (69.4%) were received by email, 353 requests were received online (28.8%), 20 requests were received by fax (1.6%) and 1 request was received by mail (0.2%).

No request was received in person or by phone.

Section 1B: Active Requests under the Privacy Act

1.3 Number of requests broken down by fiscal year received

At the end of the reporting period, 99 requests were carried over to fiscal year 2024–25. As of March 31, 2024, 72 of these requests were processed within the legislated timelines and 27 requests were beyond the legislated timelines.

Section 2: Informal requests

2.1 Number of informal requests

The IRB processed a total of 2 informal privacy requests during the reporting period. A total of 2 requests were received and closed during this reporting period with none carried over into 2024-25.

2.2 Channels of informal requests

Two requests were received via e-mail.

2.3 Completion time of informal requests

Of the 2 requests processed, 2 were closed during the reporting period. Of these 2 requests, 1 was processed within 0 to 15 days and 1 was processed within 31-60 days.

2.4 Pages released informally

From the 2 informal requests that were processed, pages were released for one of them. This represents a total of 991 pages released. For the other request, no records existed.

Section 3: Requests closed during the reporting period

3.1 Disposition and completion time

The chart below summarizes the length of time required to process the 1,172 requests completed in 2023-24.

This means that the IRB responded to a total of:

• 735 requests within 15 days (62.7%);
• 363 requests within 16-30 days (31%);
• 59 requests within 31-60 days (5%);
• 8 requests within 61-120 days (0.7%);
• 5 requests within 121-180 days (0.4%); and
• 2 requests within 181-365 days (0.2%).
  

Furthermore, and regarding the disposition:

• 22.7% of requests were closed as all disclosed;
• 7.2% of requests were closed as disclosed in part;
• 69% of requests were closed as no records exist;
• 0.9% of requests were closed as abandoned; and
• 0.2% of requests were neither confirmed nor denied.

In regard to the abandoned cases, the applicants either failed to provide sufficient information to allow the IRB to find the requested documentation or failed to obtain written consent from another individual to authorize the IRB to release the personal information.

Furthermore, a total of 809 requests (69%) could not be processed as no relevant records existed. This is because each year the IRB’s ATIP Unit receives a large volume of privacy requests from individuals in Canada who wish to obtain a letter stating that they have never applied for refugee status in order to travel to India. The Consulate General of India requires that an official letter from the IRB be attached to each application. The letter must indicate whether or not the person made a claim for refugee protection and, if they did, whether this claim was allowed, rejected, withdrawn or abandoned.

3.2 Exemptions

Section 3.2 of the statistical report outlines the exemptions that were applied in accordance with the Act. In 2023-24, the IRB relied primarily on the exemptions provided for in the following provision of the Act:

• Section 22 dealing with law enforcement and investigations; and
• Section 26 dealing with personal information.

It should be noted that if an exemption was applied several times within the same request, it is reported only once in the enclosed statistical report.

3.3 Exclusions

During the 2023-24 reporting period, no exclusions pursuant to sections 69 and 70 of the Act were applied by the IRB.

3.4 Format of information released

Consistent with the previous reporting period, the electronic format was mostly used (86.5%) for the release of information. In addition, the format of information released was audio for 47 requests (11.7%), video for 6 requests (1.5%) and data set copy in only one case (0.3%).

3.5 Complexity

3.5.1 Relevant pages processed and disclosed for paper and e-records formats

A total of 214,708 pages were processed and 173,876 were released during 2023-24. To compare, approximately 31,403 fewer pages were processed, and 36,266 fewer pages were released in 2023-24 than in the previous fiscal year.

The chart below summarizes the number of pages processed and released in the last five reporting periods:

3.5.2 Relevant pages processed by request disposition for paper and e-records formats by size of requests

In 2023-24, a total of 138 requests had fewer than 100 pages processed. In addition to that, 93 had between 100-500 pages processed, 65 had between 501-1,000 pages processed, 65 had between 1,001-5,000 pages processed, and 2 had more than 5,000 pages processed.

3.5.3 Relevant minutes processed and disclosed for audio formats

Overall, 47 requests for audio were received during 2023-24 which represents a total of 8,559 minutes that were processed and disclosed.

3.5.4 Relevant minutes processed per request disposition for audio formats by size of requests

With regard to the relevant minutes processed by size of those 47 requests, we can confirm the following:

• in 4 cases, less than 60 minutes were processed (total of 111 minutes);
• in 15 cases, between 60 and 120 minutes were processed (total of 1,400 minutes); and
• in 28 cases, more than 120 minutes were processed (total of 7,048 minutes).

3.5.5 Relevant minutes processes and disclosed for video formats

Overall, 6 requests for video were received last fiscal year which represents a total of 77 minutes.

3.5.6 Relevant minutes processed per request disposition for video formats by size of requests

All 6 requests had less than 60 minutes processed per request.

3.5.7 Other complexities

Last fiscal year, 55 requests had complexities; none required consultation, while some required legal advice (5), had interwoven information (29) or some other complexities (21).

3.6 Closed requests

3.6.1 Number of requests closed within legislated timelines

During 2023-24, 1,116 requests were closed within legislated timeframe which represent 95.22% of requests.

3.7 Deemed refusals

3.7.1 Reasons for not meeting legislated timelines

During the 2023-24 reporting period, a total of 56 requests were closed past the legislated timeline. In all cases, the reason for closing past the legislated timelines was that meeting the original time limit would have unreasonably interfered with the operations of the IRB.

3.7.2 Request closed beyond legislated timelines (including any extension taken)

Of these 56 requests, 37 were processed within 15 days past legislated timelines, 6 were processed within 16-30 days past legislated timelines, 1 was processed within 31-60 days past legislated timelines, 7 were processed within 61-120 days past legislated timelines, 4 were processed within 121-180 days past legislated timelines, and 1 was processed within 181-365 days past legislated timelines.

3.8 Requests for translations

There was no request for the translation of records from one official language to the other during the reporting period.

Section 4: Disclosures Under Subsections 8(2) and 8(5)

In 2023-24, personal information was disclosed in accordance with the following paragraphs of the Act as set out in the chart below:

As shown in the above chart, most disclosures were done under paragraphs 8(2)(d) and 8(2)(e). There were some disclosures under paragraph 8(2)(a) during 2023-24. There were none under paragraphs 8(2)(m) or 8(5).

Section 5: Requests for correction of personal information and notations

No requests for correction to personal information were made during the reporting period.  

Section 6: Extensions

6.1 Reasons for extensions

Last reporting period, all extensions were taken based on interference with operations.

6.2 Length of extensions

The length of extension that was taken for all 22 extensions was for 16 to 30 days. 

Section 7: Consultations received from other institutions and organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

There were 3 consultations received from other institutions and organizations.

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

One consultation request was received from another government of Canada institution. All records sought were disclosed entirely. The consultation was completed within 30 days.

7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada

There were also 2 consultations received from another institution or organization outside the Government of Canada. The records were disclosed entirely and processing was completed within 15 days.

Section 8: Completion time of consultations on cabinet confidences

8.1 Requests with Legal Services

There was no consultation request on Cabinet Confidence with Legal Services.

8.2 Requests with Privy Council Office

There was no consultation request on Cabinet Confidence with the Privy Council Office.

Section 9: Complaints and investigations notices received

In fiscal year 2023-24, the IRB processed 9 complaints. In total, 11 new complaints were filed with the Office of the Privacy Commissioner of Canada against the IRB. Of these, 7 complaints were closed within the fiscal year and 4 are still ongoing and have been carried over into 2024-25.

In addition, 2 complaints which had been received in previous reporting periods (1 in 2019–20 and 1 in 2021–22) were closed last fiscal year. In addition to these two complaints, 2 complaints from 2022-23 have been carried over into 2024-25.

These 11 complaints represent 0.8% of all requests received during 2023-24, including those outstanding from previous reporting periods.

Actions that were taken by the IRB during the reporting period to resolve privacy complaints involved conducting new searches to validate if any records existed and which had not been provided when initially processing the requests.

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

10.1 Privacy Impact Assessments

During 2023-24, no Privacy Impact Assessments were completed or modified.

10.2 Institution-specific and central Personal Information Banks

The IRB has seven active Personal Information Banks; however, the Board did not create or modify any Personal Information Banks in 2023-24.

Section 11: Privacy breaches

11.1 Material privacy breach reports

No material privacy breaches were reported during 2023-24.

11.2 Non-material privacy breach

During the reporting period, the IRB identified 116 new cases of non-material privacy breaches. In addition, 132 cases of non-material privacy breaches were outstanding from 2023-24. A total of 123 requests were closed and 125 active cases are currently being reviewed and have been carried over into 2024-25. The Board did not inform the Office of the Privacy Commissioner of Canada because the risk was deemed low and the information was quickly contained.

Section 12: Resources related to the Privacy Act

12.1 Allocated costs

In 2023-24, the total costs incurred by the Communications and Access to Information Directorate for the administration of the Act is estimated to be $363,764 in salaries and $22,965 in goods and services.

The chart below shows the expenditures’ breakdown for 2023-24:

12.2 Human Resources

The employee resources for this reporting period are estimated at 4 FTEs.

Training and awareness

Monitoring activities

The manager, in cooperation with the supervisor and analysts, monitors the processing times for privacy requests, on a weekly basis. In addition, ATIP staff periodically perform diagnostic activities related to the processing of the various requests received. Trends in the requested information are monitored to identify if any frequently requested types of information can be made available via other means.

The ATIP Unit follows the Access to Information Implementation Notice 2022-01: Inter-institutional Consultations and only consults other institutions when more information is needed or when the institution wishes to disclose potentially sensitive information.

Education and training activities

Three (3) awareness sessions were delivered to various management tables this year. Individual and informal training was also offered to IRB employees on request.

Policies, guidelines, procedures, and initiatives

Privacy implementation notice

The IRB continues to implement the Privacy Implementation Notice 2020-03: Protecting privacy when releasing information about a small number of individuals during the 2023–24 reporting period, to prevent inadvertent identification of individuals from small data sets in highly sensitive contexts (e.g., refugee claims).

Initiatives and Projects to Improve Privacy

The ATIP Unit continues to work with the IM/IT team to work on the acquisition and implementation of the new Request Processing Software Solution (RPSS). Once the software is in place, it will increase the efficiency of the processing of requests and modernize the delivery of services.

Social Insurance Number (SIN)

The IRB did not receive authority for a new collection or new consistent use of the SIN in 2022–2023.

Appendix A - Delegation orders (Privacy Act)

The Chairperson of the Immigration and Refugee Board of Canada, pursuant to section 73(1) of the Privay Act^{Footnote 1}, hereby designates the persons holding the positions set out in the schedule below, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Chairperson as the head of the Immigration and Refugee Board of Canada, under the provisions of the Act and related regulations set out in the Schedule opposite each position. This designation replaces all previous delegation orders.

Dated, at the City of Ottawa, this 23 day of October, 2023.

Manon Brassard,
Chairperson

Appendix B - Statistical report on the Privacy Act

Section 1: Requests under the Privacy Act

Section 2: Informal requests

Section 3: Requests closed during the reporting period

3.5 Complexity

3.6 Closed requests

3.7 Deemed refusals

Section 4: Disclosures under subsections 8(2) and 8(5)

Section 5: Requests for correction of personal information and notations

Section 6: Extensions

Section 7: Consultations received from othe institutions and organizations

Section 8: Completion time of consultations on cabinet confidences

Section 9: Complaints and investigations notices received

Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

Section 11: Privacy breaches

Section 12: Resources related to the Privacy Act

Appendix C - Supplemental Access to Information and Privacy statistical form

Section 1: Open requests and complaints under the Access to Information Act

Section 2: open requests and complaints under the Privacy Act

Section 3: Social Insurance Number (SIN)

Section 4: Universal Access under the Privacy Act