Annual Report to Parliament on the Administration of the Access to Information Act 2019-2020

Introduction

The purpose of the Access to Information Act is to extend the present laws of Canada to provide a right of access to information in records under the control of a federal government institution in accordance with the principles that:

• government information should be available to the public;
•  necessary exceptions to the right of access should be limited and specific; and
• decisions on the disclosure of government information should be reviewed independently of government.

This is the seventh annual report prepared by the Communications Security Establishment (CSE) and tabled in Parliament in accordance with section 94 of the Access to Information Act and section 20 of the Service Fees Act. It presents an overview of the agency’s activities and describes how the Access to Information and Privacy (ATIP) Office carried out its responsibilities under the Access to Information Act during the reporting period 1 April 2019 to 31 March 2020.

Mandate of the Communications Security Establishment

On August 1st, 2019 the Communications Security Establishment Act (CSE Act) entered into force as part of Bill C-59 (An Act respecting national security matters). The CSE Act sets out the five aspects of CSE’s mandate:

• helping to protect and defend Canada’s most important cyber systems;
• acquiring foreign intelligence in support of the Government of Canada’s intelligence priorities;
• conducting defensive foreign cyber operations;
• conducting active foreign cyber operations; and
• assisting federal law enforcement and security agencies, the Canadian Forces and the Department of National Defence to carry out their lawful mandates.

The CSE Act provides CSE with a modern set of authorities and also enhances the accountability framework with new oversight and review functions.

Structure of the Access to Information and Privacy Office

The ATIP Office is part of the Policy, Disclosure and Review group in CSE’s Policy and Communications Branch. The Minister of National Defence delegated all authorities under section 95 of the Access to Information Act to the Deputy Chief, Policy and Communications, the Director General, Policy, Disclosure and Review, the Director, Disclosures and Information Sharing, the Manager, Disclosures, and Supervisor, Access to Information and Privacy Operations.

A copy of the Delegation Order setting out the responsibilities under the Act appears in Appendix I of this report.

The Access to Information and Privacy Office includes a manager responsible for twelve (12) mandated full-time positions working in two distinct teams: ATIP Operations and, Privacy Policy and Governance. At the end of the reporting period, the ATIP Operations team consisted of one (1) supervisor and seven (7) analysts, while the Privacy Policy and Governance team consisted of one (1) supervisor and three (3) analysts.

In addition to preparing reports for Parliament and Treasury Board Secretariat (TBS), the ATIP Office acts on behalf of CSE as the delegated authority in dealings with TBS, and representatives of the federal Information and Privacy Commissioners regarding CSE’s administration of the Access to Information Act and Privacy Act.

Specifically, the ATIP Operations team is responsible for the following activities:

• Processing requests under the Access to Information Act and Privacy Act;
• Responding to consultation requests from other government institutions;
• Providing advice and guidance to senior management and staff of CSE on ATIP legislation and policy-related matters;
• Supporting CSE’s legislative compliance obligations under the Acts, including the application of their associated regulations, policies and guidelines;
• Representing CSE in ATIP Communities of practice, such as the TBS ATIP Community meetings;
• Drafting and implementing internal ATIP procedures, guidance documents and working aids; and,
• Providing training and other outreach initiatives to CSE staff on the administration of the Access to Information Act and the Privacy Act.

The Privacy Policy and Governance team is responsible for the following activities:

• Providing advice and guidance to senior management and staff of CSE on privacy legislation and policy related matters;
• Providing expert privacy advice and assistance to business lines in the undertaking of Privacy Impact Assessments, privacy breach management, drafting of Privacy Notice Statements, and maintenance of Personal Information Banks;
• Supporting CSE’s legislative compliance obligations under the Acts, including the application of their associated regulations, policies and guidelines;
• Representing CSE in privacy protection communities of practice;
• Coordinating the annual update of the institution’s Info Source publication, which includes a description of the agency’s organizational structure and record holdings;
• Drafting and implementing privacy-related policies, internal procedures, guidance documents and working aids; and,
• Providing training and other outreach initiatives to CSE staff on the administration of the Privacy Act with regards to the protection of personal information.

Key Activities and Accomplishments

Education and training

CSE is committed to the ongoing learning and development of its employees and has put a special emphasis on reaching new hires by delivering ATIP training to incoming co-op students. The coming into force of the CSE Act was also accompanied by significant training across the organization, through video and other means, that included refreshers on statutory responsibilities such as ATIP.

CSE has taken a tailored approach to training Subject Matter Experts (SME) on their legislative requirements, roles and responsibilities. Following this training, the ATIP Office regularly met with SMEs to respond to questions in order to facilitate their review of CSE information. Representatives from the ATIP Office also participated in CSE’s Career Fair to provide information to employees across the organization about the importance of ATIP in the Government of Canada. CSE also encourages employees to take the  Canada School of Public Service ATIP training course and the ATIP Office continues to make educational resources available via a dedicated page on internal web.

Institutional Access to Information Policies and Procedures

The ATIP Operations team continues to seek new opportunities to improve the efficiency and timeliness of processing requests. In 2019-2020, the ATIP Operations team focused on building internal partnerships with frequently tasked OPIs by moving towards processing requests electronically and by continuing to develop a rationale database to enhance decision making with respect to release of information. Frequent collaborations with CSE’s Legal Disclosures unit have allowed the ATIP Operations team to ensure that exemptions under the Access to Information Act are consistent with redactions applied during Canada Evidence Act s.38 processes.

CSE was onboarded into the ATIP Online Request Service (AORS) late in 2018-2019, giving CSE the ability to receive Access to Information requests online directly from the requestor. The AORS is a centralized website developed by TBS that enables users to complete access to information requests and submit them to any of the institutions that are subject to the Government of Canada’s Access to Information Act. The current reporting period includes the first full year CSE has accepted the requests through AORS  system. CSE received 65 requests in this manner, representing 76% of the total requests received.

The CSE ATIP Office is also working with activity areas within the organization to implement the Part 2 requirements of the Access to Information Act with regard to proactive publication of information. In particular, CSE applied processes to facilitate the publication of reports tabled in Parliament in a timely manner, and to publish information related to corporate activities such as memoranda to the deputy head (Chief of CSE).

Challenges and Complexities

CSE recognizes transparency as an important element in maintaining public trust. The ATIP Office plays a key role in helping CSE to meet its national security transparency commitments by fulfilling information disclosure obligations while protecting classified information with significant national security implications. CSE continues to face challenges stemming from the volume of materials to be reviewed coupled with the complexity of disclosure of national security information, which at times leads to unavoidable delays. CSE also has ongoing constraints in maintaining ATIP resource levels, as recruiting staff with ATIP expertise at the high security clearance level required  for CSE staff is challenging.

Statistical Report on the Administration of the Access to Information Act

Number and Origin of Formal Requests

During the 2019-2020 reporting period, CSE received 85 requests under the ATIA (compared to 66, 104, 144, and 92 in 2018-2019, 2017-2018, 2016-2017 and 2015-2016 respectively) which represents an increase from the 2018-2019 reporting period but an overall decrease from the last several reporting periods. CSE carried over an additional 75 requests from the previous reporting period into 2019-2020. By the end of the 2019-2020 fiscal year, CSE closed 69 requests and carried-forward 91 requests into the next reporting period. In general, the requests received during 2019-2020 involved information of a more sensitive nature and encompassed a greater volume of records than requests received in previous years, resulting in greater complexity in fulfilling them. Media has been the largest source of requests for the past four reporting periods accounting for 67% of new requests in 2019-2020. Requests from the Public and Academia made up 15% and 11% of the total requests received respectively. Access Consultations received from other government departments also significantly increased from previous reporting periods.

Long description - Table: 1

Table: Received Requests

Source	Received Requests
	2015-2016	2016-2017	2017-2018	2018-2019	2019-2020
Access	92	144	104	66	85
Access Consultations	74	79	105	107	152

Disposition of Completed Requests

CSE closed 69 requests during this reporting period. Of these, 50 were disclosed in part, three (3) resulted in full disclosure and none were exempted in their entirety. Disclosures-in-part accounted for 72% of completed requests. There were eight (8) cases in which no records existed and four (4) requests were abandoned by the  applicants. CSE closed eight (8) more ATIA requests in 2019-2020 than the previous year and will endeavour to increase this number in the next reporting period. The closed requests encompassed 25,213 pages processed, a significant increase from the 2,565 pages in 2018-2019. This increase can be attributed to several requests with a large volume of records received during previous reporting periods being completed in 2019-2020. As CSE’s public profile continues to increase, the complexity/volume of  requests made under the Access to Information Act has continued to rise. The significant increase in the volume of pages in consultations received and the difficulty of  maintaining sufficient resources made finalizing requests a challenge.

Long description - Table: 2

Table: Closed Requests

Source	Closed Requests
	2015-2016	2016-2017	2017-2018	2018-2019	2019-2020
Access	87	138	82	61	69
Access Consultations	79	75	82	96	108

Long description - Table: 3

Disposition	Completed Requests
	2015-2016	2016-2017	2017-2018	2018-2019	2019-2020
All Disclosed	5%	4%	1%	7&	4%
Disclosed in part	64%	71%	55%	61%	72%
All Exempted	1%	2%	2%	2%	0%
All Excluded	0%	0%	0%	0%	0%
No records exist	6%	11%	20%	16%	12%
Request abandoned	18%	8%	11%	3%	6%
Neither confirm nor Deny	6%	2%	11%	11%	3%
Request Transferred	0%	1%	0%	0%	3%

Neither Confirm Nor Deny

Section 10(2) of the Act states that institutions do not have to disclose to a requester whether a record exists. Section 10(2) was designed to address situations in which the mere confirmation of a record’s existence (or non-existence) would reveal information that could be protected under the Act. Access to information best practices recommend that the application of section 10(2) be limited to circumstances where the confirmation or denial of the existence of a record would be injurious to Canada’s foreign relations, the defence of Canada, law enforcement activities and the safety of individuals, and the possible disclosure of personal information. When notifying a requester that it is invoking this provision, institutions must also indicate the part of the Act on which a refusal could reasonably be expected to be based if the record existed. The application of subsection 10(2) was used on two (2) occasions during the 2019-2020 reporting period.

Completion Time

Almost half of ATIP requests were closed within 30 days in the 2019-2020 reporting period. This can be attributed to the volume and complexity of requests, as well as shortage of required resources. The 28 requests closed within 30 days in 2019-2020 represent 41% of the total completed requests. Several requests closed outside the 30 days were a result of extensions based on volume and the need for external consultations. CSE closed 18 requests in 31 to 60 days; 14 requests between 61 to 120 days; three (3) requests between 121 to 180 days; four (4) request between 181-365 days; and two (2) took more than 365 days to process. Ninety-one (91) requests were carried forward into 2020-2021 compared to 75 from 2018-2019 into 2019-2020 due to the increased complexity of the requests received. In general, the requests received during 2019-2020 involved information of a more sensitive nature and encompassed a greater volume of records than requests received in previous years, resulting in greater complexity in fulfilling them.

Long description - Table: 4

Table: Completion Time

Days	Completion Time
	2015-2016	2016-2017	2017-2018	2018-2019	2019-2020
Closed within 30 days	55%	58%	55%	43%	41%
31 to 60 days	9%	9%	23%	26%	26%
61 to 120 days	23%	15%	10%	21%	20%
121 to 180 days	2%	4%	10%	3%	4%
181 to 365 days	5%	7%	1%	5%	6%
More than 365 days	6%	7%	1%	2%	3%

Exemptions to the Release of Information

The exemption most applied by CSE was subsection 15(1) - Defence of the Access to Information Act. It was applied to protect information which could be reasonably expected to be injurious to the defence of Canada on 51 requests. Subsection 15(1) – International Affairs was also used 11 times to protect information that could be injurious to the conduct of international affairs. Other exemptions that were applied throughout the course of the fiscal year are paragraphs 16(2)(c), information relating to the vulnerability or methods used to protect particular buildings or other structures or systems and 19(1), personal information of individuals. The application of subsection 21(1), advice and recommendations, was consistent with its application in previous reporting periods.

Long description - Table: 5

Table: Exemptions Applied (%)

Disposition	Completed Requests
	2015-2016	2016-2017	2017-2018	2018-2019	2019-2020
13(1)a)	33%	20%	9%	0%	8%
15(1)-Def.	98%	94%	96%	100%	98%
15(1) - A.I.	37%	41%	9%	21%	21%
16(2)c)	32%	39%	43%	32%	46%
19(1)	40%	38%	40%	37%	27%
21(1)a)	12%	30%	13%	11%	15%
21(1)b)	9%	13%	13%	18%	15%
21(1)c)	5%	4%	4%	3%	2%
21(1)d)	2%	11%	0%	5%	4%
23	26%	20%	6%	5%	4%
24(1)	5%	9%	4%	0%	0%

Extension of the Time Limit

There were three (3) extensions taken pursuant to paragraph 9(1)(a) of the Access to Information Act, however CSE took 18 extensions under paragraph 9(1)(b) to conduct consultations that could not be completed within the original time limit and one (1) extension under paragraph 9(1)(c) to conduct third party consultations in accordance with subsection 27(1) of the Act. There was an increase in extensions taken from the 2018-2019 reporting period, mainly attributed to an increase in the volume and complexity of requests.

Consultations

CSE was consulted on 152 requests during this fiscal year compared to 107 for the previous reporting period. Other government institutions accounted for 150 of the consultations while two (2) new consultation requests were received from other organizations. In addition to the 152 new consultations, 43 were carried over from 2018-2019, resulting in 195 ongoing consultation requests in 2019-2020, totalling 18,089 pages for review. CSE closed 106 consultations and carried-over 87 into 2020-2021. Consultation requests on historical records continue to contribute to an increase in volume. The historical consultation requests comprise 74 of the 87 consultations carried over into 2020-2021.

Requests Treated Informally

CSE responded to 66 informal requests for records previously released under the ATIA process in 2019-2020. This is an increase from the 58 informal requests completed in 2018-2019. CSE responded to 51 of the informal requests within 15 days and the remaining 15 within 30 days.

COVID‑19

CSE was impacted by COVID‑19 during the reporting period and transitioned its activities to a work-from-home posture. As a result, ATIP analysts experienced significant challenges to continue regular operations for the period of March 13, 2020 to March 31, 2020 due to the inability to access classified information responsive to requests.  CSE is examining ways in which to modify its processes to further enable analysts to perform some of their duties remotely as needed in 2020-2021.

Fees and Costs

The Service Fees Act requires a responsible authority to report annually to Parliament on the fees collected by the institution.

With respect to fees collected under the Access to Information Act, the information below is reported in accordance with the requirements of section 20 of the Service Fees Act.

• Enabling authority: Access to Information Act
• Fee amount: $5, the only fee charged for an ATI request
• Total revenue: $410
• Fees waived: In accordance with the Interim Directive on the Administration of the Access to Information Act, issued on May 5, 2016, the Communications Security Establishment waives all fees prescribed by the Act and Regulations, other than the $5 application fee set out in paragraph 7(1)(a) of the Regulations. CSE waived the $5 application fee for one (1) request during the reporting period.
• Cost of operating the program: $573,188.

Complaints, Judicial Review and Audits

Individuals who are not satisfied with the processing of their access to information request can file a complaint with the Office of the Information Commissioner of Canada (OIC).

The OIC received one (1) complaint against CSE in 2019-2020, due to a general refusal/delay complaint. The OIC closed four (4) complaints against CSE that had been carried over from previous reporting periods. CSE provided information to the OIC in relation to all complaints as requested.

At the end of 2019-2020, the OIC had three (3) complaints pending with CSE. CSE continues to work closely with the OIC in order to resolve complaints in an efficient manner

Monitoring Compliance

Using our case management software, the ATIP Office continued to produce reports on the time taken to process requests. These reports were shared with our ATIP Coordinator throughout the fiscal year. CSE’s Executive Committee (made up of DM and ADM level executives) is also informed of the status of Access to Information Act requests on a weekly basis.

Appendix I: Delegation of Authority

Communications Security Establishment

Access to Information Act Delegation Order

The Minister of National Defence, pursuant to section 73 or the Access to information Act, hereby designates the persons holding the positions set out below, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Minister of National Defence as the head of the Communications Security Establishment, under the provisions of the Access to information Act and related regulations set out below for each position.

• Chief, Communication Security Establishment: joint authority under subsection 20(6) (public interest disclosure) with the Deputy Chief, Policy and Communications.
• Deputy Chief, Policy and Communication : full authority, except joint authority under subsection20(6) (public interest disclosure) with the Chief, Communications Security Establishment.
• Director General, Policy, Disclosure and Review: full authority, except for paragraph 20(6) (public interest discloure).
• Director, Disclosures and In formation Sharing: full authority, except for subsection 20(6) (public interest disclosure).
• Manager, Disclosures: full authority, except for subsection 20(6) (public interest disclosure).
• Supervisor, Access to Information and Privacy Operations: subsection 7(a) only when no record exists (notice) section 9 (extension of time limits), section 11 (fees), sections 27 and 28(consultation to third party documents).

This delegation order replaces all previous delegation orders.

Dated at Ottawa, this 26th day of April 2018.

Original signed by:
The Hon. Harjit S. Sajjan, PC,OMM. MSM. CD. MP

Appendix II: Statistical report

Statistical Report on the Access to Information Act

Name of institution: Communications Security Establishment

Reporting period: 2019-04-01 to 2020-03-31

Section 1: Requests under the Access to Information Act

Note: All requests previously recorded as “treated informally” will now be accounted for in this section only.

Section 2: Decline to act on vexatious, made in bad faith or abuse of right requests

Section 3: Requests Closed During the Reporting Period

3.4 Format of information released

3.5 Complexity

3.6 Closed requests

3.6.1 Number of requests closed within legislated timelines

3.7 Deemed refusals

Section 4: Extensions

Section 6: Consultations received from other institutions and organizations

Section 7: Completion time of consultations on Cabinet confidences

Section 9: Court Action

9.1 Court actions on complaints received before June 21, 2019 and on-going

9.2 Court actions on complaints received after June 21, 2019

Section 10: Resources Related to the Access to Information Act

Note: Enter values to two decimal places.

2019-2020 Supplemental Statistical Report – Requests affected by COVID‑19 measures

In addition to completing the forms for the Statistical Reports on the ATIA and Privacy Act for 2019-20, institutions are asked to complete this Supplemental Report to help identify the impact of COVID‑19 measures on institutional performance for 2019-20 and going forward. The data requirements are set out in the tables below.

Supplemental Statistical Report on the Access to Information A

The following table reports the total number of formal requests received during two periods; 2019-04-01 to 2020-03-13 and 2020-03-14 to 2020-03-31.

The following table reports the total number of requests closed within the legislated timelines and the number of closed requests that were deemed refusals during two periods 2019-04-01 to 2020-03- 13 and 2020-03-14 to 2020-03-31.

The following table reports the total number of requests carried over during two periods; 2019-04-01 to 2020-03-13 and 2020-03-14 to 2020-03-31.