Annual Report to Parliament on the Privacy Act

1. Introduction

The Canadian Grain Commission (CGC) presents to Parliament its Annual Report on the Administration of the Privacy Act (the “Act”) for fiscal year 2019-2020 (April 1, 2019 to March 31, 2020). This report is prepared and tabled in accordance with section 72 of the Act.

The purpose of the Act is to protect the privacy of individuals with respect to personal information about themselves held by a government institution and to provide individuals with a right of access to that information.

In accordance with Treasury Board of Canada Secretariat (TBS) requirements, this report provides an overview of the CGC’s activities in administering its responsibilities under the Act. This report should be considered along with CGC’s 2019-2020 Annual Report to Parliament on the Administration of the Access to Information Act, which is tabled separately.

The CGC is a federal government department, which administers the provisions of the Canada Grain Act (CGA). The CGC’s mandate, as set out in the CGA, is to, “in the interests of producers, establish and maintain standards of quality for Canadian grain and regulate grain handling in Canada, to ensure a dependable commodity for domestic and export markets”.

The CGC’s Core Responsibility is Grain Regulation, or, to regulate grain handling in Canada and to establish and maintain science-based standards for Canadian grain. The CGC regulates the handling of 20 grains grown in Canada to protect producer rights and ensure the integrity of grain transactions.

The Departmental Results of this Core Responsibility are that domestic and international markets regard Canadian grain as dependable and safe and that farmers are fairly compensated for their grain. The CGC supports its Core Responsibility through its programs: Grain Quality, Grain Research, and Safeguards for Grain Farmers.

2. Access to Information and Privacy Office structure

The CGC is supported by Agriculture and Agri-Food Canada’s (AAFC) Access to Information and Privacy (ATIP) office who assists in processing and responding to access to information and privacy requests received by the CGC.

The CGC’s Chief Operating Officer is responsible for the coordination and implementation of policies, guidelines and procedures to ensure compliance with the Access to Information Act and the Privacy Act.

The CGC has an access to information and privacy coordinator whose key responsibilities include:

• Ensuring timely processing of all ATIP requests and coordinating with AAFC’s ATIP office for processing the CGC’s ATIP requests;
• Proactively disclosing summaries of closed access requests on the CGC’s website;
• Providing CGC staff with advice and guidance on ATIP-related matters;
• Preparing annual reports to Parliament and maintaining the CGC’s Info Source chapter; and
• Developing and updating Personal Information Banks (PIBs).

3. Delegation of authority

The Chief Commissioner of the CGC is responsible for responding to requests made under the Privacy Act. Section 73(1) of the Act provides for the delegation of the powers, duties and functions designated by the Act.

The Chief Operating Officer of the CGC leads the CGC’s operations and reports to the Chief Commissioner. This position has full delegated authority of the powers, duties and functions designated by the Act.

The delegation of authority instrument for the administration of the Privacy Act is appended hereto at Annexes A and B.

4. Privacy Act Statistical Report

The CGC’s detailed Statistical Report on the Act for April 1, 2019 to March 31, 2020 is appended hereto in Annex C.

5. ATIP training and education

During the reporting period, the AAFC ATIP office provided training sessions to approximately 40 CGC employees. Training highlights from that session include:

• An overview of the access to information administrative processes;
• A definition of employee roles and responsibilities in relation to fulfilling CGC’s responsibilities under the Act;
• The principles of the duty to assist; and
• An overview of exemptions and exclusions.

The CGC continues to review and develop information management practices and procedures within the organization as part of an ongoing records and information management project.

6. Privacy polices, guidelines, procedures and engagement

The CGC did not implement any new or revise any existing privacy policies, guidelines or procedures during the 2019 to 2020 fiscal period.

7. Privacy complaints, investigations and audits

No complaints were received in relation to CGC’s obligations under the Act. No investigations or audits were carried out.

8. Monitoring timelines

Requests received under the Act by the CGC are monitored by AAFC’s ATIP office using an automated system to ensure the timely processing of privacy requests. The workflow case management tool used by AAFC tracks all actions and due dates, stores relevant records requiring review, maintains audit logs, promotes the use of standard templates, allows extensive search capability to facilitate analysis and generates progress and statistical reports.

CGC’s ATIP Coordinator monitors the time to process privacy requests by completing an internal tracking log spreadsheet, which is updated to reflect key dates and activities for all requests including deadlines. Senior management is kept apprised of the privacy activities on a strict need-to-know basis only.

9. Material privacy breaches

In May 2014, TBS launched the updated Guidelines for Privacy Breaches based on changes made to the Directive on Privacy Practices. The updated guidelines and directive establish a mandatory requirement for departments to report all material privacy breaches to the Office of the Privacy Commissioner and TBS. In accordance with the Guidelines, a breach is defined as “material” if the breach “involves sensitive personal information and could reasonably be expected to cause serious injury or harm to the individual and/or involves a large number of affected individuals.”

No material privacy breaches occurred during the reporting period.

10. Privacy impact assessments

Privacy impact assessments (PIAs) are used to determine whether privacy risks may be present in new or existing CGC programs or initiatives that manage personal information for administrative purposes.

The CGC did not complete any PIAs during the reporting period.

11. Disclosures pursuant to paragraph 8(2)(m)

Paragraph 8(2)(m) of the Act allows for the disclosure of personal information without the consent of the individual in specific circumstances. During the reporting period, no such disclosures were made under that paragraph.

12. Closing

In closing, the CGC is fully committed to both the spirit and the intent of the Act. The CGC will continue to work proactively to protect the personal information of its employees and the Canadian public that is under its control.

Annex A – Privacy Act Delegation Order - Canadian Grain Commission

Privacy Act Delegation Order - Canadian Grain Commission

The Chief Commissioner of the Canadian Grain Commission (CGC), pursuant to section 73(1) of the Privacy Act, hereby delegates the persons of the CGC holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers and perform the duties and functions of the Chief Commissioner as the head of a government institution under the sections of the Act as set out in the schedule opposite each position. This Delegation Order supersedes all previous orders.

Annex B – Delegation of authority instrument for the administration of the Privacy Act

Annex C - Statistical report on the Privacy Act

Name of institution: Canadian Grain Commission

Reporting period: 2019-04-01 to 2020-03-31

2.5 Complexity