Annual Report to Parliament on the Administration of the Access to Information Act 2020-2021

Introduction

The purpose of the Access to Information Act is to extend the present laws of Canada to provide a right of access to information in records under the control of a federal government institution in accordance with the principles that:

• government information should be available to the public;
• necessary exceptions to the right of access should be limited and specific; and
• decisions on the disclosure of government information should be reviewed independently of government.

This is the eighth annual report prepared by the Communications Security Establishment (CSE) and tabled in Parliament in accordance with section 94 of the Access to Information Act and section 20 of the Service Fees Act. It presents an overview of the agency’s activities and describes how the Access to Information and Privacy (ATIP) Office carried out its responsibilities under the Access to Information Act during the reporting period 1 April 2020 to 31 March 2021.

Mandate of the Communications Security Establishment

On August 1^st, 2019 the Communications Security Establishment Act (CSE Act) entered into force as part of Bill C-59 (An Act respecting national security matters). The CSE Act sets out the five aspects of CSE’s mandate:

• helping to protect and defend Canada’s most important cyber systems;
• acquiring foreign intelligence in support of the Government of Canada’s intelligence priorities;
• conducting defensive foreign cyber operations;
• conducting active foreign cyber operations; and
• providing technical and operational assistance to federal law enforcement and security agencies, the Canadian Forces and the Department of National Defence.

The CSE Act provides CSE with a modern set of authorities and also enhances the accountability framework with new oversight and review functions.

Structure of the Access to Information and Privacy Office

The ATIP Office is part of the Policy, Disclosure and Review group in CSE’s Policy and Communications Branch. The Minister of National Defence delegated all authorities under section 95 of the Access to Information Act to the Deputy Chief, Policy and Communications, the Director General, Policy, Disclosure and Review, the Director, Disclosures and Information Sharing, the Manager, Disclosures, and Supervisor, Access to Information and Privacy Operations. A copy of the Delegation Order setting out the responsibilities under the Act appears in Appendix I of this report.

The Access to Information and Privacy Office includes a manager responsible for ten (10) full-time positions working in two separate teams: ATIP Operations and, Privacy Policy and Governance. At the end of the reporting period, the ATIP Operations team consisted of one (1) supervisor and four (4) analysts, while the Privacy Policy and Governance team consisted of one (1) supervisor and four (4) analysts.

In addition to preparing reports for Parliament and Treasury Board Secretariat (TBS), the ATIP Office acts on behalf of CSE as the delegated authority in dealings with TBS, and representatives of the federal Information and Privacy Commissioners regarding CSE’s administration of the Access to Information Act and Privacy Act.

Specifically, the ATIP Operations team is responsible for the following activities:

• Processing requests under the Access to Information Act and Privacy Act;
• Responding to consultation requests from other government institutions;
• Providing advice and guidance to senior management and staff of CSE on ATIP legislation and policy-related matters;
• Supporting CSE’s legislative compliance obligations under the Acts, including the application of their associated regulations, policies and guidelines;
• Representing CSE in ATIP Communities of practice, such as the TBS ATIP Community meetings;
• Drafting and implementing internal ATIP procedures, guidance documents and working aids; and,
• Providing training and other outreach initiatives to CSE staff on the administration of the Access to Information Act and the Privacy Act.

The Privacy Policy and Governance team is responsible for the following activities:

• Providing advice and guidance to senior management and staff of CSE on privacy legislation and policy-related matters;
• Providing expert privacy advice and assistance to business lines in the preparation of Privacy Impact Assessments, privacy breach management, drafting of Privacy Notice Statements, and maintenance of Personal Information Banks;
• Supporting CSE’s legislative compliance obligations under the Acts, including the application of their associated regulations, policies and guidelines;
• Representing CSE in privacy protection communities of practice;
• Coordinating the annual update of the institution’s Info Source publication, which includes a description of the agency’s organizational structure and record holdings;
• Drafting and implementing privacy-related policies, internal procedures, guidance documents and working aids; and,
• Providing training and other outreach initiatives to CSE staff on the administration of the Privacy Act with regards to the protection of personal information.

Key Activities and Accomplishments

Education and training

CSE is committed to the ongoing learning and development of its employees and has put a special emphasis on reaching new hires by delivering ATIP training to incoming co-op students. The coming into force of the CSE Act was also accompanied by significant training across the organization, through video and other means, that included refreshers on statutory responsibilities such as ATIP.

CSE has taken a tailored approach to training Subject Matter Experts (SME) on their legislative requirements, roles and responsibilities. Following this training, the ATIP Office regularly met with SMEs to respond to questions in order to facilitate their review of CSE information. Representatives from the ATIP Office also participated in CSE’s Career Fair to provide information to employees across the organization about the importance of ATIP in the Government of Canada. CSE also encourages employees to take the Canada School of Public Service ATIP training course and the ATIP Office continues to make educational resources available via a dedicated page on the internal web.

Institutional Access to Information Policies and Procedures

The ATIP Operations team continues to seek new opportunities to improve the efficiency and timeliness of processing requests. In 2020-2021, the ATIP Operations team focused on building internal partnerships with frequently tasked Offices of Primary Interest (OPIs) by moving towards processing requests electronically and by continuing to develop a rationale database to enhance decision making with respect to release of information. Frequent collaborations with CSE’s Legal Disclosures unit have allowed the ATIP Operations team to ensure that exemptions under the Access to Information Act are consistent with redactions applied during Canada Evidence Act s.38 processes.

CSE was onboarded into the ATIP Online Request Service (AORS) late in 2018-2019, giving CSE the ability to receive Access to Information requests online directly from the requestor. The AORS is a centralized website developed by TBS that enables users to complete access to information requests and submit them to any of the institutions that are subject to the Government of Canada’s Access to Information Act. CSE received 37 requests in this manner, representing approximately 90% of the total requests received. This is an increase from 76% in 2019-2020 and can likely be attributed to the pandemic as well as the convenience of submitting requests online.

The CSE ATIP Office is also working with activity areas within the organization to implement the Part 2 requirements of the Access to Information Act with regard to proactive publication of information. In particular, CSE applied processes to facilitate the publication of reports tabled in Parliament in a timely manner, and to publish information related to corporate activities such as memoranda to the deputy head (Chief of CSE).

Challenges and Complexities

In its five-year strategic framework, CSE 2025, CSE identifies being “Known and Trusted” as an important pillar of its vision, and recognizes as a result the importance that Canadians understand CSE’s contributions to Canada, and are confident that CSE respects the law and protects their privacy. The ATIP Office plays a key role in helping CSE meet its national security transparency commitments by fulfilling information disclosure obligations while protecting classified information with significant national security implications. CSE continues to face challenges stemming from the volume of materials to be reviewed coupled with the complexity of national security information, which at times leads to unavoidable delays. CSE also has ongoing constraints in maintaining ATIP resource levels, as recruiting staff with ATIP expertise at the high security clearance level required for CSE staff is challenging.

COVID-19

CSE was impacted by COVID-19 pandemic during the reporting period and transitioned its activities to a work-from-home posture. Due to the nature of CSE’s national security operations, CSE operates in a high-security environment and manages large volumes of classified information. The restrictions and health guidelines introduced in response to the pandemic challenged regular business continuity planning procedures by limiting the number of people operating in CSE facilities and, in turn, access to the records responsive to requests. In addition, the pandemic impacted regular operations by limiting access of staff to CSE facilities and infrastructure, which in turn restricted ATIP analysts’ ability to review the classified material and process the requests.

In Spring and Summer 2020, CSE adjusted its ATIP operational procedures to expand the scope of ATIP business processes that may be completed remotely during the restrictions introduced by the pandemic. CSE also initiated an effort to transform its ATIP operational procedures to support ATIP operations in both its classified and unclassified environments to enable analysts to perform their duties remotely as may be needed.

Statistical Report on the Administration of the Access to Information Act

Number and Origin of Formal Requests

During the 2020-2021 reporting period, CSE received 41 requests under the ATIA (compared to 85, 66, 104, and 144 in 2019-2020, 2018-2019, 2017-2018, and 2016-2017 respectively) which represents a decrease from the 2019-2020 reporting period and an overall decrease from the last several reporting periods. CSE carried over an additional 91 requests from the previous reporting period into 2020-2021. By the end of the 2020-2021 fiscal year, CSE closed 20 requests and carried-forward 112 requests into the next reporting period. Like in previous years, the requests covered information that included highly sensitive material, which makes for a complex process to respond to. The decrease of CSE’s request closure rate can be attributed to the restrictions created by the pandemic which limited staff access to CSE facilities to search and/or review classified systems and material. Media has been the largest source of requests for the past four reporting periods accounting for 48% of new requests in 2020-2021. Requests from the Public and Academia made up 34% and 12% of the total requests received respectively. Access Consultations received from other government departments also decreased from previous reporting periods.

Long description - Table: 1

Table: Received Requests

Source	Received Requests
	2016-2017	2017-2018	2018-2019	2019-2020	2020-2021
Access	144	104	66	85	41
Access Consultations	79	105	107	152	65

Disposition of Completed Requests

CSE closed 20 requests during this reporting period. Of these, 11 (55%) were disclosed in part, none resulted in full disclosure and none were exempted in their entirety. There were four cases in which no records existed and three requests were abandoned by the applicants. The closed requests encompassed 1,126 pages processed, a significant decrease from the 25,213 pages in 2019-2020. This decrease can be attributed to several requests with a large volume of records received during previous reporting periods being completed in 2019-2020. As CSE’s public profile continues to increase, the complexity/volume of requests made under the Access to Information Act has continued to rise. CSE’s ability to process requests was limited throughout the reporting period due to the pandemic. The classified nature of CSE’s operations required most review to occur in the CSE facility. Ensuring a safe work environment combined with the difficulty of maintaining sufficient resources made finalizing requests a challenge.

Long description - Table: 2

Table: Closed Requests

Source	Closed Requests
	2016-2017	2017-2018	2018-2019	2019-2020	2020-2021
Access	138	82	61	69	20
Access Consultations	75	82	96	108	55

Long description - Table: 3

Disposition	Completed Requests
	2016-2017	2017-2018	2018-2019	2019-2020	2020-2021
All Disclosed	4%	1%	7%	4%	0%
Disclosed in part	71%	55%	61%	72%	55%
All Exempted	2%	2%	2%	0%	0%
All Excluded	0%	0%	0%	0%	0%
No records exist	11%	20%	16%	12%	20%
Request abandoned	8%	11%	3%	6%	15%
Neither confirm nor Deny	2%	11%	11%	3%	10%
Request Transferred	1%	0%	0%	3%	0%

Neither Confirm Nor Deny

Section 10(2) of the Act states that institutions do not have to disclose to a requester whether a record exists. Section 10(2) was designed to address situations in which the mere confirmation of a record’s existence (or non-existence) would reveal information that could be protected under the Act. Access to information best practices recommend that the application of section 10(2) be limited to circumstances where the confirmation or denial of the existence of a record would be injurious to Canada’s foreign relations, the defence of Canada, law enforcement activities, the safety of individuals, or the possible disclosure of personal information. When notifying a requester that it is invoking this provision, institutions must also indicate the part of the Act on which a refusal could reasonably be expected to be based if the record existed. The application of subsection 10(2) was used on two occasions during the 2020-2021 reporting period.

Completion Time

Four ATIP requests were closed within 30 days in the 2020-2021 reporting period. This can be attributed to the volume and complexity of requests, as well as the shortage of required resources due to pandemic restrictions. The four requests closed within 30 days in 2020-2021 represent 36% of the total completed requests. Several requests closed outside the 30 days were a result of extensions based on volume and the need for external consultations. CSE closed three requests in 31 to 60 days; three requests between 61 to 120 days; two requests between 121 to 180 days; five requests between 181- 365 days; and three took more than 365 days to process. 112 requests were carried forward into 2021-2022 compared to 91 from 2019-2020 into 2020-2021 due to the pressures created by the pandemic that limited CSE’s ability to process files. In general, the requests received during 2020-2021 involved information of a highly sensitive nature, resulting in greater complexity in fulfilling them.

Long description - Table: 4

Table: Completion Time

Days	Completion Time
	2016-2017	2017-2018	2018-2019	2019-2020	2020-2021
Closed within 30 days	58%	55%	43%	41%	20%
31 to 60 days	9%	23%	26%	26%	15%
61 to 120 days	15%	10%	21%	20%	15%
121 to 180 days	4%	10%	3%	4%	10%
181 to 365 days	7%	1%	5%	6%	25%
More than 365 days	7%	1%	2%	3%	15%

Exemptions to the Release of Information

The exemption most applied by CSE was subsection 15(1) - Defence of the Access to Information Act. It was applied to protect information which could be reasonably expected to be injurious to the defence of Canada on 11 requests. Subsection 15(1) – International Affairs was also used four times to protect information that could be injurious to the conduct of international affairs. Other exemptions that were applied throughout the course of the fiscal year are paragraphs 16(2)(c), information relating to the vulnerability or methods used to protect particular buildings or other structures or systems and 19(1), personal information of individuals. The application of subsection 21(1), advice and recommendations, was consistent with its application in previous reporting periods.

Long description - Table: 5

Table: Exemptions Applied (%)

Disposition	Completed Requests
	2016-2017	2017-2018	2018-2019	2019-2020	2020-2021
13(1)a)	20%	9%	0%	8%	9%
15(1)-Def.	94%	96%	100%	98%	100%
15(1) - A.I.	41%	9%	21%	21%	36%
16(2)c)	39%	43%	32%	46%	73%
19(1)	38%	40%	37%	27%	36%
21(1)a)	30%	13%	11%	15%	27%
21(1)b)	13%	13%	18%	15%	27%
21(1)c)	4%	4%	3%	2%	0%
21(1)d)	11%	0%	5%	4%	18%
23	20%	6%	5%	4%	45%
24(1)	9%	4%	0%	0%	0%

Extension of the Time Limit

There was one extension taken pursuant to paragraph 9(1)(a) of the Access to Information Act. However, CSE took six extensions under paragraph 9(1)(b) to conduct consultations that could not be completed within the original time limit and no extensions under paragraph 9(1)(c) to conduct third party consultations in accordance with subsection 27(1) of the Act. There was a decrease in extensions taken from the 2019-2020 reporting period, mainly attributed to the reduced volume of requests received and the limited ability for analysts to work from the CSE facility through the pandemic.

Consultations

CSE was consulted on 65 requests during this fiscal year compared to 152 for the previous reporting period. Other federal government institutions accounted for 65 of the consultations while no consultation requests were received from non-federal government organizations. In addition to the 65 new consultations, 87 were carried over from 2019-2020, resulting in 152 ongoing consultation requests in 2020-2021, totalling 13,379 pages for review. CSE closed 55 consultations and carried over 97 into 2021-2022. Consultation requests for records of historic nature (e.g. during cold war era) continue to contribute to the volume of consultations. The historical consultation requests comprise 78 of the 97 consultations carried over into 2021-2022.

Requests Treated Informally

CSE responded to 15 informal requests for records previously released under the ATIA process in 2020-2021. This is a decrease from the 66 informal requests completed in 2019-2020. CSE responded to the 15 requests within 15 days of the request.

Fees and Costs

The Service Fees Act requires a responsible authority to report annually to Parliament on the fees collected by the institution.

With respect to fees collected under the Access to Information Act, the information below is reported in accordance with the requirements of section 20 of the Service Fees Act.

• Enabling authority: Access to Information Act
• Fee amount: $5, the only fee charged for an ATI request
• Total revenue: $195
• Fees waived: In accordance with the Interim Directive on the Administration of the Access to Information Act, issued on May 5, 2016, and the changes to the Access to Information Act that came into force on June 21, 2019, the Communications Security Establishment waives all fees prescribed by the Act and Regulations, other than the $5 application fee set out in paragraph 7(1)(a) of the Regulations.
• Cost of operating the program: $599,187.

Thirty-seven (37) requests were received through the AORS. This service, which is managed by TBS accounts for $185 of the total fees collected. The remaining $10 correspond to two requests where the applicant provided the fees directly to CSE for processing.

Complaints, Judicial Review and Audits

Individuals who are not satisfied with the processing of their access to information request can file a complaint with the Office of the Information Commissioner of Canada (OIC).

The OIC notified CSE of three complaints in 2020-2021; The OIC closed two complaints against CSE, one carried over from a previous reporting period and one that was received during the current reporting period. CSE provided information to the OIC in relation to all complaints as requested.

The first closed complaint was a refusal complaint received in March of 2017. On initial receipt of the request, CSE had attempted to re-scope it with the complainant as the original text was not specific enough to enable an effective search for records but received no response to its communications. The request was considered as abandoned by the requester. CSE made representations to the OIC at the time the complaint notification was received. The OIC followed up on the complaint in January 2020. CSE and the OIC agreed on a re-wording of the request and proceeded with retrieval of records. The OIC notified CSE that the request was discontinued in August 2020.

The second closed complaint was a delay complaint received in November 2020. CSE released the requested information to the complainant in December 2020. In January 2021, the OIC closed the complaint as well-founded and resolved. CSE received notification of a refusal complaint in January 2021 on the same request after the complainant had received the release package. CSE made representations to the OIC regarding the second complaint at the time it was received. The OIC had not yet assigned an investigator at the end of the current reporting period.

The third notification received during the reporting period was a refusal complaint received in February 2021. CSE responded to the initial request neither confirming nor denying the existence of responsive records. CSE will make representations to the OIC in the 2021-2022 reporting period and will continue to work with the OIC to resolve this complaint.

At the end of 2020-2021, the OIC had three (3) complaints pending with CSE. CSE continues to work closely with the OIC to resolve complaints in an efficient manner.

Monitoring Compliance

Using our case management software, the ATIP Office continued to produce reports on the time taken to process requests. These reports were shared with our ATIP Coordinator throughout the fiscal year. CSE’s Executive Committee (made up of DM and ADM level executives) is also informed of the status of Access to Information Act requests on a weekly basis.

Appendix I: Delegation of Authority

Communications Security Establishment

Access to Information Act Delegation Order

The Minister of National Defence, pursuant to section 73 or the Access to information Act, hereby designates the persons holding the positions set out below, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Minister of National Defence as the head of the Communications Security Establishment, under the provisions of the Access to information Act and related regulations set out below for each position.

• Chief, Communication Security Establishment: joint authority under subsection 20(6) (public interest disclosure) with the Deputy Chief, Policy and Communications.
• Deputy Chief, Policy and Communications: full authority, except joint authority under subsection 20(6) (public interest disclosure) with the Chief, Communications Security Establishment.
• Director General, Policy, Disclosure and Review: full authority, except for paragraph 20(6) (public interest discloure).
• Director, Disclosures and Information Sharing: full authority, except for subsection 20(6) (public interest disclosure).
• Manager, Disclosures: full authority, except for subsection 20(6) (public interest disclosure).
• Supervisor, Access to Information and Privacy Operations: subsection 7(a) only when no record exists (notice) section 9 (extension of time limits), section 11 (fees), sections 27 and 28(consultation to third party documents).

This delegation order replaces all previous delegation orders.

Dated at Ottawa, this 26th day of April 2018.

Original signed by:
The Hon. Harjit S. Sajjan, PC,OMM. MSM. CD. MP

Appendix II: Statistical report

Statistical Report on the Access to Information Act

Name of institution: Communications Security Establishment

Reporting period: 2020-04-01 to 2021-03-31

Section 1: Requests under the Access to Information Act

Note: All requests previously recorded as “treated informally” will now be accounted for in this section only.

Section 2: Decline to act on vexatious, made in bad faith or abuse of right requests

Section 3: Requests Closed During the Reporting Period

3.4 Format of information released

3.5 Complexity

3.6 Closed requests

3.6.1 Number of requests closed within legislated timelines

3.7 Deemed refusals

Section 4: Extensions

Section 6: Consultations received from other institutions and organizations

Section 7: Completion time of consultations on Cabinet confidences

Section 9: Court Action

9.1 Court actions on complaints received before June 21, 2019 and on-going

9.2 Court actions on complaints received after June 21, 2019

Section 10: Resources Related to the Access to Information Act

Note: Enter values to two decimal places.

Supplemental Statistical Report on the Access to Information Act and Privacy Act

Name of institution: Communications Security Establishment

Reporting period: 2020-04-01 to 2021-03-31

Section 1: Capacity to Receive Requests

Section 2: Capacity to Process Records