Annual Report to Parliament on the Administration of the Access to Information Act 2021-2022

Introduction

The purpose of the Access to Information Act is to extend the present laws of Canada to provide a right of access to information in records under the control of a federal government institution in accordance with the principles that:

• government information should be available to the public;
• necessary exceptions to the right of access should be limited and specific; and
• decisions on the disclosure of government information should be reviewed independently of government.

This is the ninth annual report prepared by the Communications Security Establishment (CSE) and tabled in Parliament in accordance with section 94 of the Access to Information Act and section 20 of the Service Fees Act. It presents an overview of the agency’s activities and describes how the Access to Information and Privacy (ATIP) Office carried out its responsibilities under the Access to Information Act during the reporting period 1 April 2021 to 31 March 2022.

Mandate of the Communications Security Establishment

On August 1^st, 2019 the Communications Security Establishment Act (CSE Act) entered into force as part of Bill C-59 (An Act respecting national security matters). The CSE Act sets out the five (5) aspects of CSE’s mandate:

• helping to protect and defend Canada’s most important cyber systems;
• acquiring foreign intelligence in support of the Government of Canada’s intelligence priorities;
• conducting defensive foreign cyber operations;
• conducting active foreign cyber operations; and
• providing technical and operational assistance to federal law enforcement and security agencies, the Canadian Forces and the Department of National Defence.

The CSE Act provides CSE with a modern set of authorities and also enhances the accountability framework with new oversight and review functions.

Structure of the Access to Information and Privacy Office

The ATIP Office is part of the Transparency and Information Sharing group in CSE’s Authorities, Compliance and Transparency Branch. This is a change from the previous reporting period and stems from organizational changes made within CSE as part of the strategic goal to uphold the highest standards of compliance, lawfulness, and respect for the privacy of Canadians. The delegation order in effect at the end of 2021 to 2022 reflects the previous structure and a copy can be found in Appendix I of this report. The Minister of National Defence delegated all authorities under section 95 of the Access to Information Act to the Deputy Chief, Policy and Communications, the Director General, Policy, Disclosure and Review, the Director, Disclosures and Information Sharing, and to the Manager, Disclosures. He also delegated limited authorities to the Supervisor, Access to Information and Privacy Operations. The delegation order is being revised to reflect the organizational changes.

The Access to Information and Privacy Offices include a manager responsible for thirteen (13) full-time positions working in two (2) separate teams: ATIP Operations and, Privacy Policy and Governance. At the end of the reporting period, the ATIP Operations team consisted of one (1) supervisor and six (6) analysts, while the Privacy Policy and Governance team consisted of one (1) supervisor, five (5) analysts and two (2) coop students.

In addition to preparing reports for Parliament and Treasury Board Secretariat (TBS), the ATIP Office acts on behalf of CSE as the delegated authority in dealings with TBS, and representatives of the federal Information and Privacy Commissioners regarding CSE’s administration of the Access to Information Act and Privacy Act.

Specifically, the ATIP Operations team is responsible for the following activities:

• Processing requests under the Access to Information Act and Privacy Act;
• Responding to consultation requests from other government institutions;
• Providing advice and guidance to senior management and staff of CSE on ATIP legislation and policy-related matters;
• Supporting CSE’s legislative compliance obligations under the Acts, including the application of their associated regulations, policies and guidelines;
• Representing CSE in ATIP Communities of practice, such as the TBS ATIP Community meetings;
• Drafting and implementing internal ATIP procedures, guidance documents and working aids; and,
• Providing training and other outreach initiatives to CSE staff on the administration of the Access to Information Act and the Privacy Act.

The Privacy Policy and Governance team is responsible for the following activities:

• Providing advice and guidance to senior management and staff of CSE on privacy legislation and policy-related matters;
• Providing expert privacy advice and assistance to business lines in the preparation of Privacy Impact Assessments, privacy breach management, drafting of Privacy Notice Statements, and maintenance of Personal Information Banks;
• Supporting CSE’s legislative compliance obligations under the Acts, including the application of their associated regulations, policies and guidelines;
• Representing CSE in privacy protection communities of practice;
• Coordinating the annual update of the institution’s Info Source publication, which includes a description of the agency’s organizational structure and record holdings;
• Drafting and implementing privacy-related policies, internal procedures, guidance documents and working aids; and,
• Providing training and other outreach initiatives to CSE staff on the administration of the Privacy Act with regards to the protection of personal information.

Key activities and accomplishments

Education and training

CSE is committed to the ongoing learning and development of its employees and has put a special emphasis on reaching new hires by delivering ATIP training to incoming co-op students. All new employees are required to complete ATIP training during the on-boarding process.

CSE has taken a tailored approach to training Subject Matter Experts (SME) on their legislative requirements, roles, and responsibilities. Following this training, the ATIP Office regularly met with SMEs to respond to questions to facilitate their review of CSE information. Representatives from the ATIP Office also participated in CSE’s internal Career Fair to provide information to employees across the organization about the importance of ATIP in the Government of Canada. CSE also encourages employees to take the Canada School of Public Service ATIP training course and the ATIP Office continues to make educational resources available via a dedicated page on the internal web.

Institutional access to information policies and procedures

The ATIP Operations team continues to seek new opportunities to improve the efficiency and timeliness of processing requests. In 2021 to 2022, the ATIP Operations team focused on building internal partnerships with frequently tasked Offices of Primary Interest (OPIs) by moving towards processing requests electronically and by continuing to develop a rationale database to enhance decision making with respect to release of information. Frequent collaborations with CSE’s Legal Disclosures unit have allowed the ATIP Operations team to ensure that exemptions under the Access to Information Act are consistent with redactions applied during Canada Evidence Act s.38 processes.

CSE was onboarded into the ATIP Online Request Service (AORS) late in 2018 to 2019, giving CSE the ability to receive Access to Information requests online directly from the requestor. The AORS is a centralized website developed by TBS that enables users to complete access to information requests and submit them to any of the institutions that are subject to the Government of Canada’s Access to Information Act. CSE received 50 requests in this manner, representing approximately 98% of the total requests received. This is an increase from 90% in 2020 to 2021.

The CSE ATIP Office is also working with activity areas within the organization to implement the Part 2 requirements of the Access to Information Act regarding proactive publication of information. In particular, CSE applied processes to facilitate the publication of reports tabled in Parliament in a timely manner, and to publish information related to corporate activities such as memoranda to the deputy head (Chief of CSE).

Challenges and complexities

In its five-year strategic framework, CSE 2025, CSE identifies being “Known and Trusted” as an important pillar of its vision and recognizes as a result the importance that Canadians understand CSE’s contributions to Canada and are confident that CSE respects the law and protects their privacy. The ATIP Office plays a key role in helping CSE meet its national security transparency commitments by fulfilling information disclosure obligations while protecting classified information with significant national security implications. CSE continues to face challenges stemming from the volume of materials to be reviewed coupled with the complexity of national security information, which at times leads to unavoidable delays. CSE also has ongoing constraints in maintaining ATIP resource levels, as recruiting staff with ATIP expertise at the high security clearance level required for CSE staff is challenging.

COVID-19

Due to the nature of CSE’s national security operations, CSE operates in a high-security environment and manages large volumes of classified information. For this reason, the ATIP software is currently only available in the classified environment. The restrictions and health guidelines introduced in response to the pandemic challenged regular business continuity planning procedures by limiting the number of people operating in CSE facilities and, in turn, access to the records responsive to requests. In addition, the pandemic impacted regular operations by limiting access of staff to CSE facilities and infrastructure, which in turn restricted ATIP analysts’ ability to review the classified material and process classified and unclassified requests.

The ATIP operations team was able to return to pre-pandemic capabilities by the end of the reporting period. The team also began a one-year trial of a hybrid approach whereby employees were able to telework for 20% of their working hours, when their duties could be performed remotely.

Statistical report on the administration of the Access to Information Act

Number and origin of formal requests

During the 2021 to 2022 reporting period, CSE received 51 requests under the ATIA (compared to 41, 85, 66, and 104 in 2020 to 2021, 2019 to 2020, 2018 to 2019 and 2017 to 2018 respectively) which represents an increase from the 2020 to 2021 reporting period and an overall decrease from the last several reporting periods. CSE carried over an additional 112 requests from the previous reporting period into 2021 to 2022. By the end of the 2021 to 2022 fiscal year, CSE closed 14 requests and carried-forward 149 requests into the next reporting period. As in previous years, the requests covered information that included highly sensitive material, for which complex processing is required. The decrease of CSE’s request closure rate can be attributed to the restrictions created by the pandemic which limited staff access to CSE facilities to search and/or review classified systems and material. Media has been the largest source of requests for the past four (4) reporting periods accounting for 63% of new requests in 2021 to 2022. Requests from the Public and Academia made up 18% and 15% of the total requests received respectively. Access Consultations received from other government departments increased from last reporting period.

Long description - Table: 1

Table: Received requests

Source	2017 to 2018	2018 to 2019	2019 to 2020	2020 to 2021	2021 to 2022
Access	104	66	85	41	51
Access consultations	105	107	152	65	92

Disposition of completed requests

CSE closed 14 requests during this reporting period. Of these, eight (8) (57%) were disclosed in part, two (2) were fully disclosed and none were exempted in their entirety. There were three (3) cases in which no records existed and one (1) request was abandoned by the applicants. The closed requests encompassed 1,200 pages processed, a slight increase from the 1,126 pages in 2020 to 2021 but a significant decrease from 25,213 pages in 2019 to 2020. This decrease can be attributed to several requests with a large volume of records received during previous reporting periods being completed in 2019 to 2020. As CSE’s public profile continues to increase, the complexity/volume of requests made under the Access to Information Act has continued to rise. The classified nature of CSE’s operations required most review to occur in the CSE facility. Ensuring a safe work environment combined with the difficulty of maintaining sufficient resources made finalizing requests a challenge.

Long description - Table: 2

Table: Closed requests

Source	2017 to 2018	2018 to 2019	2019 to 2020	2020 to 2021	2021 to 2022
Access	82	61	69	20	14
Access consultations	82	96	108	55	82

Long description - Table: 3

Table: Disposition of completed requests

Disposition	2017 to 2018	2018 to 2019	2019 to 2020	2020 to 2021	2021 to 2022
All disclosed	1%	7%	4%	0%	14%
Disclosed in part	55%	61%	72%	55%	57%
All exempted	2%	2%	0%	0%	0%
All excluded	0%	0%	0%	0%	0%
No records exist	20%	16%	12%	20%	21%
Request abandoned	11%	3%	6%	15%	7%
Neither confirm nor denied	11%	11%	3%	10%	0%
Request transferred	0%	0%	3%	0%	0%

Neither Confirm Nor Deny

Section 10(2) of the Act states that institutions do not have to disclose to a requester whether a record exists. Section 10(2) was designed to address situations in which the mere confirmation of a record’s existence (or non-existence) would reveal information that could be protected under the Act. Access to information best practices recommend that the application of section 10(2) be limited to circumstances where the confirmation or denial of the existence of a record would be injurious to Canada’s foreign relations, the defence of Canada, law enforcement activities, the safety of individuals, or the possible disclosure of personal information. When notifying a requester that it is invoking this provision, institutions must also indicate the part of the Act on which a refusal could reasonably be expected to be based if the record existed. The application of subsection 10(2) was not used on any occasion during the 2021 to 2022 reporting period.

Completion Time

Two (2) ATIP requests were closed within 30 days in the 2021 to 2022 reporting period. This can be attributed to the volume and complexity of requests, as well as the shortage of required resources due to pandemic restrictions. These two (2) requests represent 14% of the total completed requests. Several requests closed outside the 30 days were a result of extensions based on volume and the need for external consultations. CSE closed two (2) requests in 31 to 60 days; one (1) request between 61 to 120 days; two (2) requests between 121 to 180 days; one (1) request between 181- 365 days; and six (6) took more than 365 days to process. 149 requests were carried forward into 2022-2023 compared to 112 from 2020 to 2021 into 2021 to 2022 due to the pressures created by the pandemic that limited CSE’s ability to process files. In general, the requests received during 2021 to 2022 involved information of a highly sensitive nature, resulting in greater complexity in fulfilling them. Of the total request carried over into 2022-2023, 34% were received during the 2021 to 2022 reporting period.

Long description - Table: 4

Table: Completion time

Completion time	2017 to 2018	2018 to 2019	2019 to 2020	2020 to 2021	2021 to 2022
Closed within 30 days	55%	43%	41%	20%	14%
31 to 60 days	23%	26%	26%	15%	14%
61 to 120 days	10%	21%	20%	15%	7%
121 to 180 days	10%	3%	4%	10%	14%
181 to 365 days	1%	5%	6%	25%	7%
More than 365 days	1%	2%	3%	15%	43%

Exemptions to the Release of Information

The exemption most applied by CSE was subsection 15(1) - Defence of the Access to Information Act. It was applied to protect information which could be reasonably expected to be injurious to the defence of Canada on eight (8) requests. Subsection 15(1) – International Affairs was also used once to protect information that could be injurious to the conduct of international affairs. Other exemptions that were applied throughout the course of the fiscal year are paragraphs 16(2)(c), information relating to the vulnerability or methods used to protect particular buildings or other structures or systems, 19(1), personal information of individuals and 20(1)(b), financial, commercial, scientific or technical information of a third party.

Long description - Table: 5

Table: Exemptions applied (%)

Disposition	2017 to 2018	2018 to 2019	2019 to 2020	2020 to 2021	2021 to 2022
13(1)(a)	9%	0%	8%	9%	0%
15(1) - Def	96%	100%	98%	100%	100%
15(1) - I.A.	9%	21%	21%	36%	13%
16(2)(c)	43%	32%	46%	73%	25%
19(1)	40%	37%	27%	36%	63%
20(1)(b)	15%	0%	4%	0%	25%
21(1)(a)	13%	11%	15%	27%	0%
21(1)(b)	13%	18%	15%	27%	0%
21(1)(c)	4%	3%	2%	0%	0%
21(1)(d)	0%	5%	4%	18%	0%
23	6%	5%	4%	45%	0%
24(1)	4%	0%	0%	0%	0%

Extension of the Time Limit

There was one (1) extension taken pursuant to paragraph 9(1)(a) of the Access to Information Act. However, CSE took three (3) extensions under paragraph 9(1)(b) to conduct consultations that could not be completed within the original time limit and one (1) extension under paragraph 9(1)(c) to conduct third party consultations in accordance with subsection 27(1) of the Act. There was a decrease in extensions taken from the 2020 to 2021 reporting period, attributed to our limited access to the CSE facility throughout the pandemic. This affected the team’s and our OPI’s ability to retrieve and review records in order to claim extensions within the legislative timelines.

Consultations

CSE was consulted on 92 requests during this fiscal year compared to 65 for the previous reporting period. Other federal government institutions accounted for 92 of the consultations while no consultation requests were received from non-federal government organizations. In addition to the 92 new consultations, 97 were carried over from 2020 to 2021, resulting in 189 ongoing consultation requests in 2021 to 2022, totalling 15,442 pages for review. CSE closed 82 consultations and carried over 107 into 2022-2023. Consultation requests for records of historic nature (e.g. during cold war era) continue to contribute to the volume of consultations. The historical consultation requests comprise 77 of the 107 consultations carried over into 2022-2023.

Requests Treated Informally

CSE responded to 30 informal requests for records previously released under the ATIA process in 2021 to 2022. This is a increase from the 15 informal requests completed in 2020 to 2021. CSE responded to three (3) requests within 30 days; three (3) requests between 31 and 60 days; two (2) requests between 61 and 120 days; eight (8) requests between 121 and 180 days; 12 requests between 181 and 365 days and two (2) requests in more than 365 days.

Fees and Costs

The Service Fees Act requires a responsible authority to report annually to Parliament on the fees collected by the institution.

With respect to fees collected under the Access to Information Act, the information below is reported in accordance with the requirements of section 20 of the Service Fees Act.

• Enabling authority: Access to Information Act
• Fee amount: $5.00 application fee is the only fee charged for an ATI request
• Total revenue: $250
• Fees waived:
  In accordance with the changes to the Access to Information Act that came into force on June 21, 2019, CSE may only charge an application fee of $5, as set out in paragraph 7(1)(a) of the Regulations. Pursuant to section 11 of the Access to Information Act, institutions can waive this application fee as deemed appropriate.
  In addition, CSE waives all fees, other than the $5 application fee, that may have been applicable to requests received prior to June 21, 2019. This is in accordance with the Interim Directive on the Administration of the Access to Information Act that was in effect May 5, 2016, to July 12, 2022.
  No fees were waived for the 2021 to 2022 fiscal period.
• Cost of operating the program: $498,151.

50 requests were received through the AORS. This service, which is managed by TBS accounts for the total fees collected of $250.

Complaints, Judicial Review and Audits

Individuals who are not satisfied with the processing of their access to information request can file a complaint with the Office of the Information Commissioner of Canada (OIC).

The OIC notified CSE of six (6) complaints in 2021 to 2022; The OIC closed five (5) complaints against CSE, two (2) were carried over from the previous reporting period and three (3) that were received during the current reporting period. CSE provided information to the OIC in relation to all complaints as requested.

Two (2) of the complaints were a result of delays to respond to requests and were received in May of 2021. CSE responded to the requests in July and November. As the requests were closed beyond the legislative deadlines, the OIC found both to be well founded and resolved.

A third complaint, received in January 2021, alleged that CSE had failed to conduct a reasonable search for records to respond to a request. CSE made representations to the OIC indicating the searches conducted and responded to numerous follow-up questions. Some searches were repeated and expanded upon to verify results. The OIC was satisfied that CSE had tasked the appropriate sectors to locate all relevant records, that the search was reasonable and that no additional responsive records could be located. As a result, the OIC found that the complaint was not well founded.

Two (2) of the complaints were closed as CSE received notices that they were discontinued from the OIC. One (1) complaint was received in January of 2021. The notice of discontinuation from the OIC in September of 2021 indicated that the complainant had not responded to the OIC’s requests for representations to advance the investigation. The other discontinued complaint is a result of a complainant filing nearly identical requests and filing delay complaints on both in July of 2021. In the course of discussions, the complainant agreed to amalgamate the processing of both requests into a single file. This resulted in the discontinuation of one (1) of the complaints in March 2022. The remaining complaint had not yet been closed by the end of the 2021 to 2022 reporting period.

The five (5) closed complaints noted above consist of two (2) carried over from the previous reporting period and three (3) that were received in 2021 to 2022. The three (3) remaining complaints received in the current reporting period include the second of the nearly identical requests and two (2) delay complaints. CSE has made representations to the OIC on all active complaints and will continue to work with the OIC to resolve them. The other open complaint, received in 2017 to 2018 is ongoing. CSE has agreed with the OIC on a release date in July of 2022.

At the end of 2021 to 2022, the OIC had four (4) complaints pending with CSE. CSE continues to work closely with the OIC to resolve complaints in an efficient manner.

Monitoring compliance

Using our case management software, the ATIP Office continued to produce reports on the time taken to process requests. These reports were shared with our ATIP Coordinator throughout the fiscal year. CSE’s Executive Committee (made up of DM and ADM level executives) is also informed of the status of Access to Information Act requests on a weekly basis.

Appendix I: Delegation of Authority

Communications Security Establishment

Access to Information Act Delegation Order

The Minister of National Defence, pursuant to section 73 or the Access to information Act, hereby designates the persons holding the positions set out below, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Minister of National Defence as the head of the Communications Security Establishment, under the provisions of the Access to information Act and related regulations set out below for each position.

• Chief, Communication Security Establishment: joint authority under subsection 20(6) (public interest disclosure) with the Deputy Chief, Policy and Communications.
• Deputy Chief, Policy and Communications: full authority, except joint authority under subsection 20(6) (public interest disclosure) with the Chief, Communications Security Establishment.
• Director General, Policy, Disclosure and Review: full authority, except for paragraph 20(6) (public interest discloure).
• Director, Disclosures and Information Sharing: full authority, except for subsection 20(6) (public interest disclosure).
• Manager, Disclosures: full authority, except for subsection 20(6) (public interest disclosure).
• Supervisor, Access to Information and Privacy Operations: subsection 7(a) only when no record exists (notice) section 9 (extension of time limits), section 11 (fees), sections 27 and 28(consultation to third party documents).

This delegation order replaces all previous delegation orders.

Dated at Ottawa, this 26th day of April 2018.

Original signed by:
The Hon. Harjit S. Sajjan, PC,OMM. MSM. CD. MP

Appendix II: Statistical report

Statistical Report on the Access to Information Act

Name of institution: Communications Security Establishment

Reporting period: 2021-04-01 to 2022-03-31

Section 1: Requests under the Access to Information Act

Section 2: Informal requests

Section 3: Applications to the Information Commissioner on declining to act on requests

Section 4: Requests closed during the reporting period

4.5 Complexity

4.6 Closed requests

4.7 Deemed refusals

Section 5: Extensions

Section 7: Consultations received from other institutions and organizations

Section 8: Completion time of consultations on Cabinet confidences

Section 9: Investigations and reports of finding

Section 10: Court action

Section 11: Resources related to the Access to Information Act

Note: Enter values to three decimal places.

Supplemental statistical report on the Access to Information Act and the Privacy Act

Name of institution: Communications Security Establishment

Reporting period: 2021-04-01 to 2022-03-31

Section 1: Capacity to receive requests under the Access to Information Act and the Privacy Act

Section 2: Capacity to process records under the Access to Information Act and the Privacy Act

Section 3: Open requests and complaints under the Access to Information Act

Section 4: Open requests and complaints under the Privacy Act

Section 5: Social Insurance Number (SIN)