Annual Report to Parliament on the Administration of the Access to Information Act 2018-2019

Introduction

The purpose of the Access to Information Act is to extend the present laws of Canada to provide a right of access to information in records under the control of a federal government institution in accordance with the principles that:

• government information should be available to the public;
• necessary exceptions to the right of access should be limited and specific; and
• decisions on the disclosure of government information should be reviewed independently of government.

This is the sixth annual report prepared by the Communications Security Establishment (CSE) and tabled in Parliament in accordance with section 72 of the Act. It presents an overview of the agency’s activities and describes how the Access to Information and Privacy (ATIP) Office carried out its responsibilities under the Access to Information Act during the reporting period 1 April 2018 to 31 March 2019.

Mandate of the Communications Security Establishment

In accordance with subsection 273.64(1) of the National Defence Act, CSE has a three-part mandate:

1. To acquire and use information from the global information infrastructure for the purpose of providing foreign intelligence, in accordance with Government of Canada intelligence priorities;
2. To provide advice, guidance and services to help ensure the protection of electronic information and of information infrastructures of importance to the Government of Canada; and
3. To provide technical and operational assistance to federal law enforcement and security agencies in the performance of their lawful duties.

Structure of the Access to Information and Privacy Office

The ATIP Office is part of the Policy, Disclosure and Review group in CSE’s Policy and Communications Branch. The Minister of National Defence delegated all authorities under section 73 of the Access to Information Act to the Deputy Chief, Policy and Communications, the Director General, Policy, Disclosure and Review, the Director, Disclosures and Information Sharing, the Manager, Disclosures, and Supervisor, Access to Information and Privacy Operations. A copy of the Delegation Order setting out the responsibilities under the Act appears in Appendix I of this report.

The Access to Information and Privacy Office includes a manager responsible for twelve (12) mandated full-time positions working in two distinct teams: ATIP Operations and Privacy Policy and Governance (PPG). At the end of the reporting period, the ATIP Operations team consisted of one (1) supervisor, four (4) analysts and one (1) support officer, while the PPG consists of one (1) supervisor and two (2) policy analysts.

In addition to preparing reports for Parliament and Treasury Board Secretariat (TBS), the ATIP Office acts on behalf of CSE as the delegated authority in dealings with TBS, and representatives of the federal Information and Privacy Commissioners regarding CSE’s administration of legislation.

Specifically, the ATIP Operations team is responsible for the following activities:

• Processing requests under the Access to Information Act and Privacy Act;
• Responding to consultation requests from other government institutions;
• Providing advice and guidance to senior management and staff of CSE on ATIP legislation and policy-related matters;
• Supporting CSE’s legislative compliance obligations under the Acts, including the application of their associated regulations, policies and guidelines;
• Representing CSE in ATIP Communities of practice, such as the TBS ATIP Community meetings;
• Drafting and implementing internal ATIP procedures, guidance documents and working aids; and,
• Providing training to CSE staff on the administration of the Access to Information Act and the Privacy Act.

The Privacy Policy and Governance team is responsible for the following activities:

• Providing advice and guidance to senior management and staff of CSE on privacy legislation and policy-related matters;
• Providing expert privacy advice and assistance to business lines in the undertaking of Privacy Impact Assessments, privacy breach management, drafting of Privacy Notice Statements, and maintenance of Personal Information Banks;
• Supporting CSE’s legislative compliance obligations under the Acts, including the application of their associated regulations, policies and guidelines;
• Representing CSE in privacy protection communities of practice;
• Coordinating the annual update of the institution’s Info Source publication, which includes a description of the agency’s organizational structure and record holdings;
• Drafting and implementing privacy-related internal procedures, guidance documents and working aids; and, Providing training to CSE staff on the administration of the Privacy Act with regards to the protection of personal information.

Key Activities and Accomplishments

Education and Training

CSE is committed to the ongoing learning and development of its employees and has put a special emphasis on reaching new hires by delivering ATIP training to incoming co-op students. A total of 167 new co-op students received ATIP training in fiscal year 2018-2019.

CSE has taken a tailored approach to training Subject Matter Experts (SME) on their legislative requirements, roles and responsibilities. The ATIP Office regularly met with SMEs to deliver training and respond to questions in order to facilitate their review of CSE information. Representatives from the ATIP Office also participated in CSE’s Career Fair to provide information to employees across the organization about the importance of ATIP in the Government of Canada.  CSE also encourages employees to take the Canada School of Public Service ATIP training course and the ATIP Office continues to make educational resources available via a dedicated page on the internal web.

Institutional Access to Information Policies and Procedures

In 2018-2019, the ATIP Operations team continued to streamline its procedures through an initiative with its Offices of Primary Interest (OPIs) to increase efficiency and timeliness in the processing of requests by shifting the initial review of records to the ATIP Office. This initiative will continue to be monitored for effectiveness throughout the next fiscal year.

ATIP Operations focused on building internal partnerships with frequently tasked areas by moving towards processing requests electronically and by continuing to develop a rationale database to ensure consistency between releases. Frequent collaborations with CSE’s Legal Disclosures unit have allowed the ATIP Operations team to ensure that exemptions under the Access to Information Act are consistent with redactions applied during Canada Evidence Acts.38 processes.

CSE was onboarded into the ATIP Online Request Service (AORS) late in 2018-2019, giving CSE the ability to receive Access to Information requests online directly from the requestor. The AORS is a centralized website developed by TBS that enables users to complete access to information requests and submit them to any of the institutions that are subject to the Government of Canada’s Access to Information Act.

Challenges and Complexities

As CSE strives to meet its national security and transparency commitments, the ATIP Office has endeavoured to balance CSE’s access to information disclosure obligations with the need to protect classified information with significant national security implications. CSE has faced workload pressures stemming due to the volume of materials to be reviewed for some requests coupled with the complexity of disclosure of national security information. In anticipation of the proposed amendments of An Act to amend the Access to Information Act and the Privacy Act and to make consequential amendments to other Acts (Bill C-58), the ATIP Office has been readying for the new proactive publication requirements.

Statistical Report on the Administration of the Access to Information Act

Number and Origin of Formal Requests

During the 2018-2019 reporting period, CSE received 66 requests under the ATIA (compared to 104, 144, and 92 in 2017-2018, 2016-2017 and 2015-2016 respectively) which represents a decrease from the last several reporting periods. CSE carried over an additional 70 requests from the previous reporting period into 2018-2019. By the end of the 2018-2019 fiscal year, CSE closed 61 requests totalling 2,565 pages processed, and carried-forward 75 requests into the next reporting period. In general, due to the sensitivity of the information and the volume of records, the requests received during 2018-2019 were more complex than those received in previous years. Media has been the largest source of requests for the past four reporting periods accounting for 68% of new requests in 2018-2019. Requests from the public and Academia made up 14% of the total requests received.

Long description - Table 1

Table: Received Requests

Source	Received Requests
	2014-2015	2015-2016	2016-2017	2017-2018	2018-2019
Access	98	92	144	104	66
Access Consultations	107	74	79	105	107

Disposition of Completed Requests

CSE closed 61 requests during this reporting period. Of these, 37 were disclosed in part, four (4) resulted in full disclosure and (1) one was exempted in its entirety. Disclosures-in-part accounted for 61% of completed requests. There were 10 cases in which no records existed and 2 requests were abandoned by the applicants. CSE closed 21 fewer ATIA requests in 2018-2019 than the previous year due to competing operational priorities as well as staffing challenges. As CSE’s public profile continues to increase, the complexity/volume of requests made under the Access to Information Act has continued to rise. The significant increase in the volume of pages in consultations received and the difficulty of maintaining sufficient resources made finalizing requests a challenge. CSE intends to align its resources and enhance its processes in 2019-2020 to improve on this result.

Long description - Table 2

Table: Closed Requests

Source	Closed Requests
	2014-2015	2015-2016	2016-2017	2017-2018	2018-2019
Access	128	87	138	82	61
Access Consultations	118	79	75	82	96

Long description - Table 3

Table: Disposition of Completed Requests

Disposition	Completed Requests
	2014-2015	2015-2016	2016-2017	2017-2018	2018-2019
All Disclosed	2%	5%	4%	1%	7%
Disclosed in part	60%	64%	71%	55%	61%
All Exempted	3%	1%	2%	2%	2%
All Excluded	2%	0%	0%	0%	0%
No records exist	15%	6%	11%	20%	16%
Request abandoned	13%	18%	8%	11%	3%
Neither confirm nor Deny	0%	6%	2%	11%	11%
Request Transferred	0%	0%	1%	0%	0%

Neither Confirm Nor Deny

Section 10(2) of the Act states that institutions do not have to disclose to a requester whether a record exists. Section 10(2) was designed to address situations in which the mere confirmation of a record’s existence (or non-existence) would reveal information that could be protected under the Act. Access to information best practices recommend that the application of section 10(2) be limited to circumstances where the confirmation or denial of the existence of a record would be injurious to Canada’s foreign relations, the defence of Canada, law enforcement activities and the safety of individuals, and the possible disclosure of personal information. When notifying a requester that it is invoking this provision, institutions must also indicate the part of the Act on which a refusal could reasonably be expected to be based if the record existed. The application of subsection 10(2) was used on seven (7) occasions during the 2018-2019 reporting period.

Completion Time

Almost half of ATIP requests were closed within 30 days in the 2018-2019 reporting periods. This can be attributed to the volume and complexity of requests, as well as resource issues. The 26 requests closed within 30 days in 2018-2019 represent 43% of the total completed requests. Several requests closed outside the 30 days were a result of extensions based on volume and the need for external consultations. CSE closed 16 (sixteen) requests in 31 to 60 days; thirteen (13) requests between 61 to 120 days; two (2) requests between 121 to 180 days; three (3) request between 181-365 days; and one (1) took more than 365 days to process. Seventy-five (75) requests were carried forward into 2019-2020 compared to (70) seventy from 2017-2018 into 2018-2019 due to the increased complexity of the requests received. In general, due to the sensitivity of the information and the volume of records, the requests received during 2018-2019 were more complex than those received in previous years.

Long description - Table 4

Table: Completion Time

Days	Completion Time
	2014-2015	2015-2016	2016-2017	2017-2018	2018-2019
Closed within 30 days	38%	55%	58%	55%	43%
31 to 60 days	13%	9%	9%	23%	26%
61 to 120 days	17%	23%	15%	10%	21%
121 to 180 days	8%	2%	4%	10%	3%
181 to 365 days	16%	5%	7%	1%	5%
More than 365 days	9%	6%	7%	1%	2%

Exemptions to the Release of Information

The exemption most applied by CSE was subsection 15(1) - Defence of the Access to Information Act. It was applied to protect information which could be reasonably expected to be injurious to the defence of Canada on 38 requests. Subsection 15(1) – International Affairs was also used 8 times to protect information that could be injurious to the conduct of international affairs. Other exemptions that were applied throughout the course of the fiscal year are paragraphs 16(2)(c), information relating to the vulnerability or methods used to protect particular buildings or other structures or systems and 19(1), personal information of individuals. The application of subsection 21(1), advice and recommendations, was consistent with the its application in the previous reporting period.

Long description - Table 5

Table: Exemptions Applied (%)

Disposition	Completed Requests
	2014-2015	2015-2016	2016-2017	2017-2018	2018-2019
13(1)a)	28	33	20	9	0
15(1)-Def.	99	98	94	96	100
15(1) - A.I.	32	37	41	9	21
16(2)c)	36	32	39	43	32
19(1)	31	40	38	40	37
21(1)a)	31	12	30	13	11
21(1)b)	22	9	13	13	18
21(1)c)	9	5	4	4	3
21(1)d)	6	2	11	0	5
23	14	26	20	6	5
24(1)	1	5	9	4	0

Extension of the Time Limit

There was one (1) extensions taken pursuant to paragraph 9(1)(a) of the Access to Information Act, however CSE took 10 extensions under paragraph 9(1)(b) to conduct consultations that could not be completed within the original time limit and no (0) extensions under paragraph 9(1)(c) to conduct third party consultations in accordance with subsection 27(1) of the Act. There was a decrease in extensions taken from the 2017-2018 reporting period, mainly attributed to a decrease in the number of required consultations with third parties.

Consultations

CSE was consulted on 107 requests during this fiscal year compared to 105 for the previous reporting period. Other government institutions accounted for 105 of the consultations while two (2) new consultation request was received from other organizations. CSE closed 96 consultations, and carried-over 43 into 2019-2020. In 2018-2019, CSE managed 137 ongoing consultation requests totalling 20,684 pages. Additionally, the receipt of ATIP consultation requests on historical records continues to contribute to an increase in volume resulting in 15,244 outstanding pages from the previous reporting period.

Requests Treated Informally

CSE responded to 58 informal requests for records previously released under the ATIA process in 2018-2019. This is a decrease from the 76 informal requests completed in 2017-2018. The 58 informal requests resulted in the re-release of over 104 previously disclosed packages.

Fees and Costs

The Service Fees Act requires a responsible authority to report annually to Parliament on the fees collected by the institution.

With respect to fees collected under the Access to Information Act, the information below is reported in accordance with the requirements of section 20 of the Service Fees Act.

• Enabling authority: Access to Information Act
• Fee amount: $5, the only fee charged for an ATI request
• Total revenue: $355
• Fees waived: In accordance with the Interim Directive on the Administration of the Access to Information Act, issued on May 5, 2016, the Communications Security Establishment waives all fees prescribed by the Act and Regulations, other than the $5 application fee set out in paragraph 7(1)(a) of the Regulations.
• Cost of operating the program: $475,354.

Complaints, Judicial Review and Audits

Individuals who are not satisfied with the processing of their access to information request can file a complaint with the Office of the Information Commissioner of Canada (OIC).

The OIC received one (1) complaint against CSE in 2018-2019, due to a general refusal/delay complaint. The OIC closed three (3) complaints against CSE that had been carried over from previous reporting periods. CSE provided information to the OIC in relation to all complaints as requested.

At the end of 2018-2019, the OIC had six (6) complaints pending with CSE. CSE continues to work closely with the OIC in order to resolve complaints in an efficient manner.

Monitoring Compliance

Using our case management software, the ATIP Office continued to produce reports on the time taken to process requests. These reports were shared with our ATIP Coordinator throughout the fiscal year. CSE’s Executive Committee (made up of DM and ADM level executives) is also informed of the status of Access to Information Act requests on a weekly basis. CSE will continue to focus on improving its timeliness in 2018-2019 and will continue to monitor metrics to determine program effectiveness.

Appendix I: Delegation of Authority

Communications Security Establishment

Access to Information Act Delegation Order

The Minister of National Defence, pursuant to section 73 or the Access to information Act, hereby designates the persons holding the positions set out below, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Minister of National Defence as the head of the Communications Security Establishment, under the provisions of the Access to information Act and related regulations set out below for each position.

• Chief, Communication Security Establishment: joint authority under subsection 20(6) (public interest disclosure) with the Deputy Chief, Policy and Communications.
• Deputy Chief, Policy and Communication : full authority, except joint authority under subsection20(6) (public interest disclosure) with the Chief, Communications Security Establishment.
• Director General, Policy, Disclosure and Review: full authority, except for paragraph 20(6) (public interest discloure).
• Director, Disclosures and In formation Sharing: full authority, except for subsection 20(6) (public interest disclosure).
• Manager, Disclosures: full authority, except for subsection 20(6) (public interest disclosure).
• Supervisor, Access to Information and Privacy Operations: subsection 7(a) only when no record exists (notice) section 9 (extension of time limits), section 11 (fees), sections 27 and 28(consultation to third party documents).

This delegation order replaces all previous delegation orders.

Dated at Ottawa, this 26th day of April 2018.

Original signed by:
The Hon. Harjit S. Sajjan, PC,OMM. MSM. CD. MP

Appendix II: Statistical report

Statistical Report on the Access to Information Act

Name of institution: Communications Security Establishment

Reporting period: 2018-04-01 to 2019-03-31

Part 1: Requests under the Access to Information Act

Note: All requests previously recorded as “treated informally” will now be accounted for in this section only.

Part 2: Requests closed during the reporting period

2.5 Complexity

2.6 Deemed refusals

Part 3: Extensions

Part 5: Consultations received from other institutions and organizations

Part 6: Completion time of consultations on Cabinet confidences

Part 9: Resources Related to the Access to Information Act

Note: Enter values to two decimal places.