Image
1. Introduction
This is the Canadian Human Rights Commission (the Commission) Annual Report to Parliament, submitted pursuant to section 72 of the Privacy Act.
The purpose of the Privacy Act is to protect the privacy of individuals with respect to personal information about themselves held by a government institution and to provide individuals with a right of access to that information.
Section 72 of the Privacy Act requires that the head of every government institution shall prepare, for submission to Parliament, an annual report on the administration of the Act within the institution during each fiscal year.
This report describes the work of the Commission's Access to Information and Privacy Office for the fiscal year 2024-2025.
About Us
The Commission protects and promotes human rights in Canada.
Our Mandate
We advocate for human rights, and provide enforcement and dispute resolution processes that are fair, equitable, and respect the inherent dignity of all.
We operate under the authority of the Canadian Human Rights Act, the Accessible Canada Act, the Employment Equity Act, the Pay Equity Act and the National Housing Strategy Act. We are internationally accredited as Canada's National Human Rights Institution.
2. Organizational Structure
The ATIP Office is organizationally housed within the IM/IT Division, which is part of the Corporate Management Branch.
In fiscal year 2024-2025, the ATIP Unit was composed of an ATIP Coordinator, a Senior ATIP Analyst, an ATIP Analyst, and an ATIP Officer.
The ATIP Unit processes formal and informal requests, consultations, and complaints the Commission receives pursuant to the Access to Information Act and the Privacy Act and produces Annual Reports and the Info Source in accordance with these Acts. In addition, the ATIP Unit investigates and reports on privacy incidents.
Furthermore, the ATIP Unit provides subject matter expert advice and training to all staff, compiles statistics as required and prepares weekly reports to provide updates with respect to the active Privacy Act requests, consultations, and complaints submitted to the Office of the Privacy Commissioner for senior management. It is also responsible for investigating privacy breaches and reporting any material breach to the Office of the Privacy Commissioner and the Treasury Board Secretariat.
3. Delegation Order
The Delegation Order sets out the powers, duties, and functions for the administration of the Privacy Act that has been delegated by the head of the institution, the Chief Commissioner.
The Interim Chief Commissioner has delegated her decision-making authority under the Privacy Act to the Director General of the Corporate Management Branch. The power to process requests is delegated to the ATIP Office. As the functional delegate, the Director General oversees the processing of requests, the internal investigations into privacy breaches, and the handling of complaints.
Please refer to Appendix A for a copy of the Signed Delegation Order.
4. Performance 2024-2025
During the period under review, from April 1, 2024, to March 31, 2025, the Commission's total number of Privacy Act requests were as follows:
- 31 new requests were received,
- 3 requests were outstanding from the previous reporting period, and
- No requests were outstanding from more than one reporting period.
Of these, 25 requests were closed during this reporting period and 9 were carried over within legislated timelines to the next reporting period. An extension was taken on all 9 requests. Lastly, all 3 requests outstanding from the previous fiscal year (2023-2024) were completed beyond legislated timelines and closed in fiscal year 2024-2025.
During this 2024-2025 reporting period, the Commission received 1 privacy request more than last reporting year representing a 3% increase.
We note that most requests were submitted from individuals who have filed human rights complaints at the Commission alleging discrimination based on one or more of the prohibited grounds under the Canadian Human Rights Act.
Out of the 31 new requests received during the reporting period:
- 22 were made online;
- 5 were made by e-mail;
- 3 were mailed;
- 0 were made in person;
- 0 were made by phone; and
- 1 was received by fax.
Although the Privacy Act requires that requests for personal information be made in writing, the Commission accepts requests made by telephone when it is necessary to accommodate requesters.
Of the 25 requests closed during the reporting period, 10,240 relevant pages were processed, and 5,124 pages were released. The disposition and number of pages processed for each request was as follows:
- 6, or 24%, and totalizing 1,214 pages, were All disclosed;
- 11, or 44%, and totalizing 9,026 pages, were Disclosed in part;
- 0, or 0%, were All exempted;
- 0, or 0%, were All excluded;
- 2, or 8%, were No records exist;
- 6, or 24%, were Request abandoned; and
- 0, or 0%, were Neither confirmed nor denied.
The completion times of the 25 Privacy requests closed during the reporting period were as follows:
- 5 requests took between 0 to 15 days;
- 9 requests took between 16 to 30 days;
- 2 requests took between 31 to 60 days;
- 7 requests took between 61 to 120 days;
- 1 request took between 121 to 180 days;
- 1 request took between 181 to 365 days; and
- 0 requests took more than 365 days.
Completion times Requests closed during fiscal 2024-2025 - Text version
| 0-15 days | 16-30 days | 31-60 days | 61-120 days | 121-180 days | 181-365 days | More than 365 days |
|---|---|---|---|---|---|---|
| 5 | 9 | 2 | 7 | 1 | 1 | 0 |
Image
Completion rates requests closed during fiscal 2024-2025 - Text version
| 0-15 days | 16-30 days | 31-60 days | 61-120 days | 121-180 days | 181-365 days | More than 365 days |
|---|---|---|---|---|---|---|
| 20% | 36% | 6% | 28% | 4% | 4% | 0% |
Consultations:
A consultation is when the record(s) responding to a particular request are transmitted from another organization (federal, provincial, territorial, municipal) to the Commission for review, and to advise recommendations if any exemptions are needed.
During this reporting period, the Commission received 1 consultation request from another Government of Canada institution, reviewed 11 pages, had no concerns with the full disclosure of the records, and took 0 to 15 days to respond to the consultation. The Commission worked on one consultation outstanding from the previous reporting period (2023-2024), reviewed 380 pages, recommended disclosing the records in part, and took 16 to 30 days to respond to the consultation.
Informal requests:
An informal request is a request for information that is not processed under the Act. There are no deadlines for responding. Also, the requester has no statutory right to complain to the Office of the Privacy Commissioner of Canada.
The Commission did not receive any informal requests during this reporting period.
Multi-year trends
Figure 1 reveals the number of requests received, processed, and closed during each fiscal year over the past five years. We observe that the volume of requests received, processed, and closed was the highest in fiscal year 2021-2022. This was followed by a decline in 2022-2023, an increase in 2023-2024, and a subsequent 27% decrease during the current reporting period compared to the previous year.
Image
Figure 1. Multi-year trend on the number of requests received, processed, and closed each fiscal year - Text version
| 2020-2021 | 2021-2022 | 2022-2023 | 2023-2024 | 2024-2025 | |
|---|---|---|---|---|---|
| Number of requests | 23 | 36 | 29 | 34 | 25 |
Figure 2 shows the number of consultations processed during each reporting period for the past five years. We observe that the number of consultations processed decreased in 2023-2024 and has remained low, with less than 2 consultations processed over the past two years.
Image
Figure 2. Multi-year trend on the number of consultations processed each fiscal year - Text version
| 2020-2021 | 2021-2022 | 2022-2023 | 2023-2024 | 2024-2025 | |
|---|---|---|---|---|---|
| Number of consultations | 2 | 6 | 4 | 1 | 2 |
Concerning Figure 3, the graph shows the number of complaints processed during each reporting period over the past five years, including those received in 2024-2025 and carried from previous fiscal years. The Commission received 3 new complaints during the reporting period, and 5 complaints were carried over from previous fiscal years. This is further explained on pages 7 to 8. We can observe that the number of complaints processed in the past three fiscal years has remained consistent at 6, compared to 2 in fiscal year 2020-2021, and 8 in the reporting period.
Image
Figure 3. Multi-year trend on the number of complaints processed each fiscal year - Text version
| 2020-2021 | 2021-2022 | 2022-2023 | 2023-2024 | 2024-2025 | |
|---|---|---|---|---|---|
| Number of complaints | 2 | 6 | 6 | 6 | 8 |
Requests closed past the legislated timelines
The Commission is committed to completing requests in a timely fashion. During this reporting period, 16 requests, or 64%, were closed within the legislated timelines, while 9 requests, or 36%, were closed past the legislated timeline. The details are explained in the following table and further expanded below.
| Number of requests closed past the legislated timelines | Principal Reason | |||
|---|---|---|---|---|
| Interference with Operations / Workload | External Consultation | Internal Consultation | Other | |
| 9 | 9 | 0 | 0 | 0 |
The Commission took an extension of 30 days beyond the initial legislated timeline on 11 requests pursuant to s. 15(a)(i), because meeting the original time limit would unreasonably interfere with operations. Of these, 2 were closed within legislated timelines, while 9 were closed past the legislated timelines during the reporting period as the files were voluminous.
Application of Exemptions
Partial exemptions claimed under the PA were invoked in 11 requests. For some requests, more than one exemption was invoked.
| Sections of the Privacy Act | Number of requests |
|---|---|
Section 22(1)(b) - The head of a government institution may refuse to disclose any personal information requested under subsection 12(1) the disclosure of which could reasonably be expected to be injurious to the enforcement of any law of Canada or a province or the conduct of lawful investigations, including, without restricting the generality of the foregoing, any such information (i) relating to the existence or nature of a particular investigation, | 2 |
| Section 25 - The head of a government institution may refuse to disclose any personal information requested under subsection 12(1) the disclosure of which could reasonably be expected to threaten the safety of individuals. | 1 |
| Section 26 - Information about another individual - where the head of a government institution may refuse to disclose any personal information requested under subsection 12(1) about an individual other than the individual who made the request and shall refuse to disclose such information where the disclosure is prohibited under section 8. | 11 |
| Section 27 - Protected information — solicitors, advocates and notaries - where the head of a government institution may refuse to disclose any personal information requested under subsection 12(1) that is subject to solicitor-client privilege or the professional secrecy of advocates and notaries or to litigation privilege. | 9 |
Legal Advice Sought
During the reporting period, legal advice was requested 2 times: once for a privacy request and once for general issues related to the Privacy Act.
5. Training and Awareness
The ATIP Unit provides policy and processing advice to the Commission staff on the Privacy Act as needed. During fiscal year 2024-2025, the ATIP Unit published in the Commission's monthly newsletter several messages regarding the ATIP process, best information management practices, and handling privacy incidents.
Furthermore, during fiscal year 2024-2025, Commission staff were required to complete the Access to Information and Privacy Fundamentals and Fundamentals of Information Management online courses offered by the Canada School of Public Service (CSPS) as part of their mandatory learning and training to raise awareness about ATIP and information management practices.
Employees wanting more training for their personal and professional development are also referred to the Treasury Board Secretariat training calendar and the Canada School of Public Service.
6. Policies, Guidelines, and Procedures
There were no new or revised institution-specific policies, guidelines and written procedures related to privacy that were implemented in the institution during the reporting period.
7. Initiatives and Projects to Improve Privacy
The Commission fully implemented its new Request Processing Software Solution (RPSS) ATIPXpress and used it to process all new ATIP requests received during the reporting period. The new system helps the ATIP Unit automate a number of routine ATIP operations that were completed manually in the previous case management system. For example, ATIPXpress automatically indexes records as they are ingested into the system. It also identifies most duplicate documents during the ingestion, and the overall accessibility of the released records has been improved.
8. Summary of Key Issues and Actions Taken on Complaints
The Commission received 3 new complaints during this reporting period. In addition, the Commission worked on 5 complaints that were carried over from previous fiscal years.
| COMPLAINTS RECEIVED DURING FISCAL 2024-2025 | REASON FOR COMPLAINT | STATUS |
|---|---|---|
| Received on July 31, 2024 |
|
|
| Received November 18, 2024 |
|
|
| Received November 18, 2024 |
|
|
| COMPLAINTS CARRIED FORWARD FROM PREVIOUS FISCAL YEAR 2023-2024 | REASON FOR COMPLAINT | STATUS |
|---|---|---|
| Received May 18, 2023 | Exemptions | Closed – March 11, 2025 Discontinued |
| Received January 5, 2024 |
|
|
| Received February 8, 2024 | Time limits | Ongoing |
| Received March 1, 2024 |
|
|
| COMPLAINTS CARRIED FORWARD FROM FISCAL 2021-2022 | REASON FOR COMPLAINT | STATUS |
|---|---|---|
| Received January 10, 2022 | Refusal-General | Ongoing |
9. Material Privacy Breaches
There were 0 material privacy breaches during the reporting period.
10. Privacy Impact Assessments
Preliminary Privacy Impact Assessments initiated: 0
Preliminary Privacy Impact Assessments completed: 0
Privacy Impact Assessments initiated: 0
Privacy Impact Assessments completed: 0
Privacy Impact Assessments forwarded to the Office of the Privacy Commissioner: 0
11. Public Interest Disclosures
There was no disclosure under subsection 8(2)(m) during the reporting period.
12. Monitoring Compliance
Requests are monitored daily. Information about the different processing stages is entered into the Commission's new case management system, ATIPXpress. Weekly reports of the open requests and complaints are generated and shared with the team, the ATIP Coordinator, and the ATIP Delegate.
Delays in processing requests primarily occur when consultations are needed or when handling voluminous records. When it appears that a delay in processing a request is inevitable, the ATIP staff contacts the requester. If the requester cannot be reached, the ATIP Coordinator is notified of any concerns. If necessary, the ATIP Delegate is notified to ensure that the request is being processed in a reasonable period. In addition, the Commission makes every effort to limit conducting inter-institutional consultations, but they could be carried out if requested by the ATIP Coordinator or the ATIP Delegate when there is an intention to disclose information. The ATIP Delegate will bring any issues to the Executive Director's attention and the Executive Director will discuss them with the Chief Commissioner, as required.
The Commission's procurement team has put in place internal practices to maintain privacy and confidentiality for contracts, agreements, and arrangements. For example, contracts do not include personal information, and clients are encouraged to send this information if/when required separately.
Off