Annual Report on the Privacy Act 2024‑2025

Table of contents

• Introduction
• Organizational Structure
• Delegation of Authority
• Statistics
• Interpretation of the Statistical Report
  • Section 1. Requests Under the Privacy Act
  • Section 2. Informal Requests
  • Section 3. Requests Closed During the Reporting Period
  • Section 4. Disclosures Under Subsections 8(2) and 8(5)
  • Section 5. Requests for Corrections Received of Personal Information and Notations
  • Section 6. Extensions
  • Section 7. Consultations Received from Other Institutions and Organizations
  • Section 8. Completion Time of Consultations on Cabinet Confidences
  • Section 9. Complaints and Investigations Notices Received
  • Section 10. Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)
  • Section 11. Privacy Breaches
  • Section 12. Resources Related to the Privacy Act
• Highlights
  • Training and Awareness
  • Policies, Guidelines, Procedures, and Directives
  • Complaints
  • Monitoring Compliance
  • Contracts, Agreements and Arrangements
  • Information Holdings
• Appendix A: Delegation Order

Introduction

The Canada School of Public Service (the School) is pleased to present to Parliament its annual report on the administration of the Privacy Act (the Act). This report is prepared and tabled in Parliament in accordance with section 72 of the Act and describes how the School administered and fulfilled its obligations under the Act between April 1, 2024, and March 31, 2025.

Purpose of the Privacy Act

The purpose of the Act is to provide:

• individuals with the right to access and correct personal information about themselves that is under the control of a government institution;
• the legal framework for the collection, retention, use, disclosure, disposition, and accuracy of personal information in the administration of programs and activities by government institutions subject to the Act.

Under the Act, personal information is defined as "information about an identifiable individual that is recorded in any form." Examples include information relating to:

• the national or ethnic origin, colour, religion, age, or marital status of an individual;
• the education or the medical, criminal, financial or employment history of an individual;
• the address, fingerprints or blood type of an individual;
• any identifying number, symbol or other particular identifier assigned to an individual.

The Privacy Act (R.S.C. 1985, c. P-21) was proclaimed into force on July 1, 1983.

About the Canada School of Public Service

Background

The Canada School of Public Service (the School) was created on April 1, 2004, when the legislative provisions of Part IV of the Public Service Modernization Act came into force. The School has been part of the Treasury Board Portfolio since July 2004. Operating under the authority of the Canada School of Public Service Act, the School was created from an amalgamation of the following three organizations: the Canadian Centre for Management Development, Training and Development Canada, and Language Training Canada. It reports to Parliament through the Minister of the Treasury Board, who is the Minister responsible for the School.

Read more about the School's mandate.

Responsibilities

The School has the legislative mandate to provide a range of enterprise‐wide learning activities to build individual and organizational capacity and management excellence within the core public service. Using a broad ecosystem of learning products, delivery approaches, and an online learning platform, the School provides public servants with the foundational knowledge, skills, and competencies now and in the future, to serve Canadians with excellence.

The School has one strategic outcome: Federal public service employees have the common knowledge, skills and competencies to fulfil their responsibilities in serving Canadians.

For information about the School's core responsibilities, planned results and resources, reporting framework and more, consult our Departmental Plan 2024-2025.

Organizational Structure

The School's Access to Information and Privacy (ATIP) Office is responsible for the coordination and implementation of policies, guidelines, and procedures to ensure departmental compliance with the Privacy Act and the Access to Information Act. The ATIP Office is also responsible for responding to requests made under the Acts.

The ATIP Office is housed within the Corporate Secretariat of the Communications and Engagement Directorate. When fully staffed, the School's ATIP Office has a total of six employees.

In addition to activities related to the Privacy Act, the responsibilities of the School's ATIP Office include:

• processing requests for information submitted under the Access to Information Act and requests for personal information pursuant to the Privacy Act in accordance with legislation, regulations and Treasury Board of Canada Secretariat (TBS) policies and guidelines;
• responding to ATIP consultations received from other government institutions and organizations;
• providing advice and guidance to requesters on the application of ATIP legislation, as well as promoting awareness and training to School employees;
• collaborating with the Office of the Information Commissioner and with the Office of the Privacy Commissioner on the resolution of complaints;
• reviewing departmental documents prior to disclosure on public facing websites;
• ensuring the School's information holdings (classes of records and personal information banks) are updated annually in its Info Source chapter;
• preparing statistical reports and annual reports on the administration of the Access to Information Act and Privacy Act;
• participating in ATIP community activities, such as the Treasury Board Secretariat-led ATIP coordinators and ATIP practitioners' meetings and working groups; and
• raising awareness on a variety of access to information and privacy-related matters to ensure compliance with access to information and privacy legislation.

The ATIP Office works closely with eight departmental ATIP liaison officers who are responsible for ensuring that requests are handled promptly and that relevant records are forwarded to the ATIP Office within prescribed deadlines.

Section 73.1 of the Privacy Act allows government institutions to provide services related to access to personal information to another government institution that is presided over by the same minister. In
2024–25, the Canada School of Public Service's ATIP Office did not provide any such services.

Further to reporting requirements for non-operational "paper" subsidiaries, the School did not have any such entities during this reporting period.

Delegation of Authority

Statistics

Interpretation of the Statistical Report Report

The following outlines the information contained in the Statistical Report on the Privacy Act for the
2024–2025 reporting period.

Section 1. Requests Under the Privacy Act

1.1 Number of requests

During the 2024–2025 reporting period, the School's ATIP Office received 16 new requests, of which 12 were closed within the same period. There were no outstanding requests carried over from previous reporting periods.

The ATIP Office carried forward four requests into the 2025–2026 reporting period. All of these were from the 2024–2025 reporting period and were carried forward within their legislated timelines (including extensions).

1.2 Channels of requests

Of the 16 requests received in 2024-2025, 13 were submitted electronically via the Access to Information and Personal Information Online Request Service and three were submitted by email.

Section 2. Informal Requests

An informal request is defined as a request for information made to the ATIP Office of a government institution that does not follow the formal procedures outlined in the Act. There are no prescribed timelines for responding and the requester has no statutory right of complaint to the Privacy Commissioner of Canada.

2.1 Number of informal requests

The ATIP Office did not receive any informal requests during the reporting period.

2.2 Channels of informal requests

The ATIP Office did not receive any informal requests during this reporting period. Consequently there are no channels of informal requests to report.

2.3 Completion time of informal requests

The ATIP Office did not receive any informal requests during this reporting period. Consequently there is no completion time of informal requests to report.

2.4 Pages released informally

The ATIP Office did not receive any informal requests during this reporting period. Consequently no pages were processed and released informally.

Section 3. Requests Closed During the Reporting Period

3.1 Disposition and completion time

Of the 12 requests closed during this reporting period, 10 (83%) were completed within 30 days, and two (17%) required 61 to 120 days to complete.

Among the 12 closed requests, no relevant records existed under the control of the School for two requests (17%), and four requests (33%) were abandoned by the requester. The remaining six requests were released as follows: four (33%) were disclosed in part, and two (17%) were fully disclosed.

3.2 Exemptions

During the reporting period, two exemptions were cited in five closed requests — section 26 (cited four times) and section 27 (cited once).

Section 26 – Information about another individual

The head of a government institution may refuse to disclose any personal information requested under subsection 12(1) about an individual other than the individual who made the request and shall refuse to disclose such information where the disclosure is prohibited under section 8.

Section 27 – Protected information — solicitors, advocates and notaries

The head of a government institution may refuse to disclose any personal information requested under subsection 12(1) that is subject to solicitor-client privilege or the professional secrecy of advocates and notaries or to litigation privilege.

3.3 Exclusions

No exclusion provisions were applied to requests that were closed during this reporting period.

3.4 Format of information released

Of the 12 requests closed, six were released in electronic format, while the remaining six were either abandoned or yielded no responsive records.

3.5 Complexity

The following sections detail several factors impacting the complexity of requests that were completed during this reporting period.

3.5.1 Relevant pages processed and disclosed for paper and e-record formats

Of the 12 requests closed, 10 requests (including six with responsive records and four that were abandoned) generated a total of 8,516 pages processed, while two had no responsive records. The total number of relevant pages disclosed, either in full or in part, was 4,007.

3.5.2 Relevant pages processed per request disposition for paper and e-record formats

Of the six requests that generated records, four involved 100 pages or fewer (totaling 193 pages processed), and two involved between 1,001 and 5,000 pages (totaling 8,323 pages processed).

3.5.3 Relevant minutes processed and disclosed for audio formats

The ATIP Office did not process any relevant minutes in audio format.

3.5.4 Relevant minutes processed and disclosed for audio formats by size of requests

The ATIP Office did not process nor disclose any relevant minutes in audio format for any requests.

3.5.5 Relevant minutes processed and disclosed for video formats

The ATIP Office did not process any relevant minutes in video format.

3.5.6 Relevant minutes processed and disclosed for video formats by size of requests

The ATIP Office did not process nor disclose any relevant minutes in video format for any requests.

3.5.7 Other complexities

There were no complexities to any of the requests closed.

3.6 Closed requests

The following section details the number of requests closed within legislated timelines.

3.6.1 Requests closed within legislated timelines

Of the 12 requests closed, 11 were completed within legislated timelines – indicating a compliance rate of 91.66%.

Table 3.6.1 Requests closed within legislative timelines - Multi year overview

3.7 Deemed refusals

The following sections provide context on the rationales applied to requests considered deemed refusal during this reporting period.

3.7.1 Reasons for not meeting legislative timelines

During the reporting period, the School closed one request that exceeded the legislated timeline and therefore fell into deemed refusal. This request was a complex file containing 4,423 pages of records.

3.7.2 Requests closed beyond legislated timelines (including any extension taken)

The one request closed beyond its legislated timeline involved a 30-day extension; however, it ultimately required 93 days to complete.

3.8 Requests for translation

The ATIP Office did not receive or process any requests for translation of responsive records during this reporting period.

Section 4. Disclosures Under Subsections 8(2) and 8(5)

Permissible disclosure pursuant to subsection 8(2) of the Act describes the circumstances under which personal information under the control of government institutions may be disclosed without the consent of the individual to whom the information pertains. In 2024-2025, the ATIP Office made no permissible disclosures under paragraph 8(2)(e) or 8(2)(m).

Other permissible disclosures not captured by the statistical report include:

There was one disclosure authorized under paragraph 8(2)(d) pursuant to a request from the Department of Justice. The Act permits the disclosure of personal information to the Attorney General of Canada for use in legal proceedings involving the Crown in right of Canada or the Government of Canada.

There was one disclosure authorized under paragraph 8(2)(f) pursuant to an agreement or arrangement between the Government of Canada and another jurisdiction for the purpose of administering or enforcing any law or carrying out a lawful investigation.

There was one disclosure authorized under paragraph 8(2)(h) pursuant to officers or employees of the institution for internal audit purposes, or to the office of the Comptroller General or any other person or body specified in the regulations for audit purposes.

Section 5. Requests for Correction of Personal Information and Notations

The ATIP Office did not receive any requests for correction of personal information or notations.

Section 6. Extensions

6.1 Requests for extensions

Section 15 of the Act allows the head of a government institution to extend the time period in respect to a request under the following circumstances: (a) a maximum of thirty days if

• (i)meeting the original time limit would unreasonably interfere with the operations of the government institution, or
• (ii)consultations are necessary to comply with the request that cannot reasonably be completed within the original time limit.

Due to a large volume of records, a total of three extensions were invoked under paragraph 15(a)(i) of the Act during this reporting period.

6.2 Length of extensions

The ATIP Office applied three extensions during this reporting period, which fell within the 16 to 30 day criteria.

Section 7. Consultations Received from Other Institutions and Other Organizations

7.1 Consultations received from other Government of Canada institutions and other organizations

The ATIP Office did not receive any requests for consultations from other Government of Canada institutions or from other organizations.

7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

The ATIP Office did not receive any requests for consultations from other Government of Canada institutions.

7.3 Recommendations and completion time for consultations received from other organizations

The ATIP Office did not receive any requests for consultation from other organizations.

Section 8. Completion Time of Consultations on Cabinet Confidences

8.1 Requests with legal services

The ATIP Office did not send any consultation requests for legal services.

8.2 Requests with Privy Council Office

The ATIP Office did not send any consultation requests on Cabinet Confidences to the Privy Council Office.

Section 9. Complaints and Investigations Notices Received

At the start of the 2024–2025 reporting period, the ATIP Office had no outstanding complaints, and no new complaints were received during the period. As of now, there are no outstanding complaints pursuant to the Act.

The annual statistical report requires institutions to identify sections of the Act under complaint:

• Section 31 captures a new formal complaint received from the OPC
• Section 33 requires the institution to make representations against a complaint to the OPC
• Section 35 is the formal finding of the OPC and closure of the complaint

Section 10. Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

10.1 Privacy Impact Assessments

A privacy impact assessment (PIA) is a risk evaluation of the flow of personal information held within a program or service. This process enables departments to determine whether new or substantially modified technologies, information systems, initiatives or proposed programs meet federal government privacy requirements.

During this reporting period, the School did not complete any PIAs.

Table 10.1 Privacy Impact Assessments – Multi-year overview

10.2 Institution-specific and central personal information banks

The School has six institution-specific personal information banks (PIB):

• Four Particular PIBs – Describing personal information about federal employees (current and former) that are contained in Schools records; and
• Two Central Employee PIBs - Records describing information about employees from other government institutions.

Section 11. Privacy Breaches

11.1 Material privacy breaches reported

A material privacy breach is an incident involving the unauthorized collection, use or disclosure of personal information that could reasonably be expected to create a real risk of significant harm to an individual.

During this reporting period, the ATIP Office did not report any material privacy breaches to the Office of the Privacy Commissioner or to the Treasury Board of Canada Secretariat.

11.2 Non-material privacy breached reported

A non-material privacy breach is defined as the improper or unauthorized creation, collection, use, disclosure, retention, or disposition of personal information. A privacy breach that does not attain the status of a material privacy breach is a non-material privacy breach, or simply a privacy breach.

The ATIP Office addressed one non-material privacy breach during this reporting period.

Section 12. Resources Related to the Privacy Act

12.1 Allocated costs

During the reporting period, the ATIP Office spent a total of $87,819, which was allocated to salaries and goods and services. This amount does not include the resources required of the School's program areas to meet the requirements under the Act.

12.2 Human Resources

A total of 0.850 combined full-time equivalents (FTEs) were dedicated to privacy-related activities.

Highlights

2024-2025 Points of interest

Training and Awareness

The 2024–25 fiscal year was a productive period for the School's ATIP Office. In addition to processing requests, the Office worked to improve internal processes and services, providing robust guidance to its Offices of Primary Interest and School officials. With a strong focus on Client services the ATIP Office continues to strive for on-time compliance with requests active in its queue. It also supports departmental programs and shares its expertise to advance initiatives beyond the requirements of the Access to Information and Privacy Acts.

The ATIP Office is committed to enhancing its information products and resources, providing School employees and liaison officers with essential, up-to-date information on access to information and privacy. These efforts aim to uphold both individual and institutional accountabilities in accordance with the Acts.

The School ensures all employees complete the mandatory privacy training outlined in the Directive on Privacy Practices. As part of this commitment, the School includes Access to Information and Privacy Fundamentals (COR502) as a required course for all School employees.

On a quarterly basis, directors and managers receive reports identifying outstanding mandatory courses for their direct reports.

In addition to the regular support and guidance provided to sectors processing ATIP requests, the ATIP Office delivered eight bilingual information sessions on access to information and privacy legislation to over 80 School employees. Some sessions were tailored to meet the specific needs of certain teams and sectors.

Employees of the ATIP Office are required to complete the following courses annually, ensuring that staff remain equipped with up-to-date knowledge and practical skills relevant to their day-to-day responsibilities:

• COR503 – Access to Information in the Government of Canada
• COR504 – Privacy in the Government of Canada

Additionally, ATIP Office staff participate in all sessions organized by the Access to Information and Privacy Communities Development Office at the Treasury Board of Canada Secretariat (TBS).

Policies, Guidelines, Procedures, and Initiatives

In response to Treasury Board amendments to the Policy on Privacy Protection and the Directive on Privacy Practices effective October 9, 2024, the ATIP Office proactively updated its privacy documentation, including the following templates:

• Privacy Impact Assessment (PIA) Checklist
• Privacy Protocol
• Personal Information Bank
• Web Summaries
• Privacy Impact Assessment

Additionally, guidelines and procedures on privacy impact assessments (PIA) were revised in support of the new Directive. The revised guidelines now emphasize the early integration of privacy considerations into system design and procurement processes. By conducting PIAs at the outset of a project, the School now proactively identifies and mitigates privacy risks before they become embedded in operations. This shift aligns with the principles of privacy by design and enhances the School's ability to comply with legal and regulatory obligations under the new Directive.

Finally, the new guidance mandates regular review and updating of PIAs to reflect changes in activities and programs. This ongoing evaluation helps maintain the relevance and effectiveness of privacy safeguards over time.

Complaints

At the start of the 2024–2025 reporting period, the ATIP Office had no outstanding complaints, and none were received during the period. As of now, there are no outstanding complaints pursuant to the Act.

Monitoring Compliance

The ATIP Office regularly updates senior management on active requests. This includes a weekly report and ongoing verbal briefings with senior management and liaison officers.

Of the 12 requests closed, all but one were completed within legislated timelines – indicating a compliance rate of 91.66%.

Contracts, Agreements and Arrangements

The School ensures that appropriate privacy protections are included in contracts by adhering to the requirements of the Privacy Act and relevant TBS policies and directives. More specifically, it:

• Uses standard contract clauses: Contracts include mandatory privacy and security clauses that align with TBS policies, ensuring contractors understand and comply with obligations related to handling personal information.
• Conducts, as appropriate, privacy impact assessments (PIAs): The School assesses how personal information will be collected, used, disclosed, and stored, including when third parties are involved.
• Assigns accountability: Designated officials are responsible for monitoring and ensuring contractor compliance with privacy requirements.

Applies information security standards: Contracts must comply with IT security standards like the Policy on Government Security to protect data from unauthorized access or breaches.

Information Holdings

The School publishes an inventory of its information holdings, as well as relevant details about personal information under its control.

The primary purpose of this inventory is to assist individuals in exercising their rights under the Access to Information Act and the Privacy Act. The inventory also supports the federal government's commitment to facilitate access to information on its activities, since it is available to the public on the Internet, free of charge.

A description of the School's functions, programs, activities and related information holdings can be found here: Info-Source: Sources of Federal Government and Employee Information - CSPS (csps-efpc.gc.ca).

Appendix A: Delegation order

Privacy Act

The President of the Canada School of Public Service, pursuant to section 73 of the Privacy Act, hereby designates the persons holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the President, as the head of the Canada School of Public Service, under the provisions of the Act and related regulations set out in the schedule opposite each position. This designation replaces all previous delegation orders.

Schedule

Contact us Subscribe to the GCLearning newsletter

---

Features

Microsoft Word 365 Suite (TRN248)

GC Data Conference 2026

Review and Reflection Series

Follow:

• X
• YouTube
• LinkedIn
• GCLearning newsletter
• RSS