Annual Report to Parliament on the Administration of the Access to Information Act- 2017-2018

Introduction

The purpose of the Access to Information Act is to extend the present laws of Canada to provide a right of access to information in records under the control of a government institution in accordance with the principles that:

• government information should be available to the public,
• necessary exceptions to the right of access should be limited and specific, and
• decisions on the disclosure of government information should be reviewed independently of government.

This is the third annual report prepared by the Communications Security Establishment (CSE) and tabled in Parliament in accordance with section 72 of the Act. It presents an overview of the agency’s activities and describes how the Access to Information and Privacy (ATIP) Office carried out its responsibilities under the Access to Information Act during the reporting period 1 April 2017 to 31 March 2018.

Mandate of the Communications Security Establishment

In accordance with subsection 273.64(1) of the National Defence Act, CSE has a three-part mandate:

1. To acquire and use information from the global information infrastructure for the purpose of providing foreign intelligence, in accordance with Government of Canada intelligence priorities;
2. To provide advice, guidance and services to help ensure the protection of electronic information and of information infrastructures of importance to the Government of Canada; and
3. To provide technical and operational assistance to federal law enforcement and security agencies in the performance of their lawful duties.

Structure of the Access to Information and Privacy Office

The ATIP Office is part of the Policy, Disclosure and Review group in CSE’s Policy and Communications Branch. The Minister of National Defence delegated all authorities under section 73 of the Access to Information Act to the Deputy Chief, Policy and Communications; also the CSE ATIP Coordinator, and most authorities to the Director, Disclosure, Policy and Review and to the Manager, Disclosure Management. A copy of the Delegation Order setting out the responsibilities under the Act appears in Appendix I of this report.

The ATIP Office includes a manager responsible for seven (7) full-time positions working in two distinct teams: ATIP Operations and Privacy Policy and Governance (PPG). The ATIP Operations team included one (1) supervisor, two (2) analysts and one (1) support officer. The PPG consists of one (1) supervisor and two (2) policy analysts.

In addition to preparing reports for Parliament and Treasury Board Secretariat (TBS), the ATIP Office acts on behalf of CSE as the delegated authority in dealings with TBS, and representatives of the federal Information and Privacy Commissioners regarding CSE’s administration of legislation.

Specifically, the ATIP Operations team is responsible for the following activities:

• Processing requests under the Access to Information Act and Privacy Act;
• Responding to consultation requests from other government institutions;
• Providing advice and guidance to senior management and staff of CSE on ATIP legislation and policy-related matters;
• Supporting CSE’s legislative compliance obligations under the Acts, including the application of their associated regulations, policies and guidelines;
• Representing CSE in ATIP Communities of practice, such as the TBS ATIP Community meetings;
• Drafting and implementing internal ATIP procedures, guidance documents and working aids; and,
• Providing training to CSE staff on the administration of the Access to Information Act and the Privacy Act.

The Privacy Policy and Governance team is responsible for the following activities:

• Providing advice and guidance to senior management and staff of CSE on privacy legislation and policy-related matters;
• Providing expert privacy advice and assistance to business lines in the undertaking of Privacy Impact Assessments, privacy breach management, drafting of Privacy Notice Statements, and maintenance of Personal Information Banks;
• Supporting CSE’s legislative compliance obligations under the Acts, including the application of their associated regulations, policies and guidelines;
• Representing CSE in privacy protection communities of practice;
• Coordinating the annual update of the institution’s Info Source publication, which includes a description of the agency’s organizational structure and record holdings;
• Drafting and implementing privacy-related internal procedures, guidance documents and working aids; and,
• Providing training to CSE staff on the administration of the Privacy Act with regards to the protection of personal information.

Key Activities and Accomplishments

Education and Training

CSE is committed to the ongoing learning and development of its employees and has put a special emphasis on reaching new hires by delivering ATIP training to incoming co-op students. A total of 256 new and returning co-op students received ATIP training in fiscal year 2017-2018.

CSE has also taken a tailored approach to training Subject Matter Experts (SME) on their legislative requirements, roles and responsibilities. The ATIP Office delivered three (3) training sessions, reaching a total of 15 individuals. CSE also encourages employees to take the Canada School of Public Service ATIP training course and the ATIP Office continues to make educational resources available via a dedicated page on the internal web.

Institutional Access to Information Policies and Procedures

In 2017-2018, the ATIP Operations team continued to streamline its procedures by determining areas where the process could create efficiencies. It implemented an initiative with its Offices of Primary Interest (OPIs) in order to increase efficiency and timeliness in the processing of requests by shifting the initial review of records to the ATIP Office. This initiative will continue to be monitored for effectiveness throughout the next fiscal year.

ATIP Operations focused on building internal partnerships with frequently tasked areas by moving towards processing requests electronically and by continuing to develop a rationale database to ensure consistency between releases. Frequent collaborations with CSE’s Legal Disclosures unit have allowed the ATIP Operations team to ensure that exemptions under the Access to Information Act are consistent with redactions applied during Canada Evidence Act s.38 processes.

Challenges and Complexities

As CSE strives to become more transparent, the ATIP Office has endeavoured to balance disclosure with the need to protect classified information with significant national security implications, while facing ongoing resource and workload pressures. The ATIP Office is currently preparing for anticipated amendments to ATIP legislation stemming from Bill C-58, particularly with respect to proactive publications.

Statistical Report on the Administration of the Access to Information Act

Number and Origin of Formal Requests

During the 2017-2018 reporting period, CSE received 104 requests under the ATIA (compared to 144, 92, and 98 in 2016-2017, 2015-2016 and 2014-2015 respectively). This represents a decrease from the 2016-2017 reporting period, but an increase from the 2015-2016 and 2014-2015 reporting periods. The significant increase in 2016-2017 could be seen as an outlier potentially stemming from an increase in CSE’s public profile resulting in an increased interest in our activities for that reporting period. By the end of the 2017-2018 fiscal year, CSE closed 82 requests and carried-forward 70 into the next reporting period. Media has been the largest source of requests for the past four reporting periods accounting for 67% of new requests in 2017-2018. Requests from the public made up 14% of total requests received, a decrease from the 38% of the previous year. These two sources account for the majority of new requests from 2017-2018.

Long description - Table: 1

Table: Received Requests

Source	Received Requests
	2013-2014	2014-2015	2015-2016	2016-2017	2017-2018
Access	133	98	92	144	104
Access Consultations	124	107	74	79	105
Privacy	69	28	10	23	10
Privacy Consultations	1	2	2	1	2

Disposition of Completed Requests

CSE closed 82 requests during this reporting period. Of these, 45 were disclosed in part, one (1) resulted in full disclosure and two (2) were exempted in their entirety. Disclosures in part accounted for 55% of completed requests. There were 16 cases in which no records existed and 9 requests were abandoned by the applicants. CSE closed 56 fewer ATIA requests in 2017-2018 than the previous year. As CSE’s public profile has increased, the complexity/volume of requests made under the Access to Information Act has risen. The significant increase in consultations received and challenge of maintaining sufficient resources have also contributed to the decrease in closed requests. CSE intends to add resources in 2018-2019 to improve on this result.

Long description - Table: 2

Table: Closed Requests

Source	Closed Requests
	2013-2014	2014-2015	2015-2016	2016-2017	2017-2018
Access	79	128	87	138	82
Access Consultations	115	118	79	75	82
Privacy	67	24	16	22	8

Long description - Table: 3

Table: Disposition of Completed Requests

Disposition	Number of Requests
	2013-2014	2014-2015	2015-2016	2016-2017	2017-2018
All Disclosed	4%	2%	5%	4%	1%
Disclosed in part	42%	60%	64%	71%	55%
All Exempted	5%	3%	1%	2%	2%
All Excluded	0%	2%	0%	0%	0%
No records exist	22%	15%	6%	11%	20%
Request abandoned	27%	13%	18%	8%	11%
Neither confirm nor Deny	0%	6%	6%	2%	11%
Request Transferred	1%	0%	0%	1%	0%

Neither Confirm Nor Deny

Section 10(2) of the Act states that institutions do not have to disclose to a requester whether a record exists. When notifying a requester that it is invoking this provision, institutions must also indicate the part of the Act on which a refusal could reasonably be expected to be based if the record existed. Section 10(2) was designed to address situations in which the mere confirmation of a record’s existence (or non-existence) would reveal information that could be protected under the Act. It is recommended that the application of section 10(2) be limited to circumstances where the confirmation or denial of the existence of a record would be injurious to Canada’s foreign relations, the defence of Canada, law enforcement activities and the safety of individuals, and the possible disclosure of personal information. The application of subsection 10(2) was used on nine (9) occasions during the 2017-2018 reporting period.

Completion Time

The majority of ATIP requests were closed within 30 days in the 2017-2018 reporting periods. This can be attributed to increases in efficiency in the processing of requests and efforts to maintain strong relationships with Offices of Primary Interest (OPIs). Considering the volume and complexity of requests, as well as resource issues, this is a significant improvement in timeliness over the previous reporting periods. The 45 requests closed within 30 days in 2017-2018 represent 55% of the total completed requests. CSE closed 19 requests in 31 to 60 days; eight (8) requests between 61 to 120 days; eight (8) requests between 121 to 180 days; one (1) request between 181- 365 days; and one (1) took more than 365 days to process. Seventy (70) requests were carried forward into 2018-2019 compared to 48 from 2016-2017 into 2017-2018 due to the increased complexity of the requests received.

Long description - Table: 4

Table: Completion Time

Days	Completion Time
	2013-2014	2014-2015	2015-2016	2016-2017	2017-2018
Closed within 30 days	49%	38%	55%	58%	55%
31 to 60 days	20%	13%	9%	9%	23%
61 to 120 days	13%	17%	23%	15%	10%
121 to 180 days	1%	8%	2%	4%	10%
181 to 365 days	16%	16%	5%	7%	1%
More than 365 days	0%	9%	6%	7%	1%

Exemptions to the Release of Information

The exemption most applied by CSE was subsection 15(1) - Defence of the Access to Information Act. It was applied to protect information which could be reasonably expected to be injurious to the defence of Canada on 45 requests. Subsection 15(1) – International Affairs was also used 4 times to protect information that could be injurious to the conduct of international affairs. Other exemptions that were applied throughout the course of the fiscal year are paragraphs 16(2)(c), information relating to the vulnerability or methods used to protect particular buildings or other structures or systems and 13(1)(a), information obtained in confidence from the government of a foreign state or an institution thereof. There was also a marked decrease in the application of all paragraphs of subsection 21(1), advice and recommendations, in comparison to the 2016-2017 reporting period.

Extension of the Time Limit

There were no extensions taken pursuant to paragraph 9(1)(a) of the Access to Information Act, however CSE took 12 extensions under paragraph 9(1)(b) to conduct consultations that could not be completed within the original time limit and six (6) extensions under paragraph 9(1)(c) to conduct third party consultations in accordance with subsection 27(1) of the Act. There was a 34% decrease in extensions taken from the 2016-2017 reporting period, mainly attributed to a decrease in the number of consultations with other Government departments.

Consultations

CSE was consulted on 105 requests during this fiscal year compared to 79 for the previous reporting period. Other government institutions accounted for 104 of the consultations while one (1) new consultation request was received from other organizations. CSE closed 82 consultations, and carried-over 32 into 2018-2019. As with formal requests under the Access to Information Act, the complexity of consultations and receipt of ATIP consultation requests on historical records has contributed to the dramatic increase resulting in 11,921 more pages being reviewed in 2017-2018 than in 2016-2017.

Requests Treated Informally

CSE responded to 79 informal requests for records previously released under the ATIA process in 2017-2018. This is a significant increase from the 47 informal requests completed in 2016-2017. The 79 informal requests resulted in the re-release of over 110 previously disclosed packages.

Fees and Costs

CSE collected $450 in application fees. Total expenditures to administer the Access to Information Act were $370,214 which is consistent with the 2016-2017 expenditures.

Complaints, Judicial Review and Audits

Individuals who are not satisfied with the processing of their access to information request can file a complaint with the Office of the Information Commissioner of Canada (OIC).

The OIC received four (4) complaints against CSE in 2017-2018. One is a general refusal/delay complaint. The remainder consist of complaints on the application of exemptions. CSE provided information to the OIC in relation to all complaints as requested. The OIC closed one (1) complaint against CSE that had been carried over from a previous reporting period (2014-2015). This exemption complaint was discontinued by the complainant. At the beginning of 2018-2019, the OIC had nine (9) complaints pending with CSE. CSE continues to work closely with the OIC in order to resolve complaints in an efficient manner.

Monitoring Compliance

Using our case management software, the ATIP Office continued to produce reports on the time taken to process requests. These reports were shared with our ATIP Coordinator throughout the fiscal year. CSE’s Executive Committee (made up of DM and ADM level executives) is also informed of the status of Access to Information Act requests on a weekly basis. CSE will continue to focus on improving its timeliness in 2018-2019 through initiatives like the one mentioned above and will continue to monitor metrics to determine program effectiveness.

Annex A: CSEC Designation Orders

Access to Information Act Designation Order

The Minister of National Defence, pursuant to Section 73 of the Access to Information Act hereby designates the person holding the position of Director General, Policy and Communications to exercise the powers and perform the duties and functions of the Minister as head of a government institution under the Acts. The Director, Disclosure, Policy and Review and the Manager, Disclosure Management will exercise all powers and duties under the Act, with the notable exception of the public interest override provision under subsection 20(6). The Chief, CSEC, and Director General, Policy and Communications have the joint authority to invoke this provision.

The Minister also designates the following:

1. the person holding the position of Supervisor, Access to Information and Privacy, to perform the functions pursuant to the Access to Information Act under:
   • section 9 (extensions to legislative deadlines);
   • section 11 (fees);
   • sections 27 and 28 (consultations to third parties on documents)
2. the person holding the position of Supervisor, Access to Information and Privacy, to respond to requests made under the Access to Information Act if no records exist.

This Designation Order comes into effect on 1 April 2013 and supersedes all previous designation orders.

Dated at Ottawa, Ont this 26th day of March 2013.

Original signed by:
Honourable Peter Mackay, P.C., M.P.
Minister of National Defence

Annex II: Statistical report

Statistical Report on the Access to Information Act

Name of institution: Communications Security Establishment

Reporting period: 2017-04-01 to 2018-03-31

Part 1: Requests under the Access to Information Act

Note: All requests previously recorded as “treated informally” will now be accounted for in this section only.

Part 2: Requests closed during the reporting period

2.5 Complexity

2.6 Deemed refusals

Part 3: Extensions

Part 5: Consultations received from other institutions and organizations

Part 6: Completion time of consultations on Cabinet confidences

Part 9: Resources Related to the Access to Information Act