Administration of the Privacy Act Annual Report
April 1, 2023 to March 31, 2024

Introduction

This report is prepared in accordance with section 72 of the Privacy Act and is tabled in Parliament by the Minister of Health in accordance with the aforementioned section. It describes how the Canadian Institutes of Health Research (CIHR) fulfilled its responsibilities under the Act during the fiscal year beginning April 1, 2023 and ending March 31, 2024.

The Privacy Act provides citizens with the legislated right to access personal information held by the government, subject to certain limitations and specific exemptions, and protection of that information against unauthorized use and disclosure.

CIHR was created in 2000 under the authority of the CIHR Actas the Government of Canada’s health research investment agency. The mandate of CIHR as stated in the Act is:

To excel, according to internationally accepted standards of scientific excellence, in the creation of new knowledge and its translation into improved health for Canadians, more effective health services and products and a strengthened Canadian health care system.

CIHR is the largest funder of health research in Canada. Composed of 13 “virtual” institutes and three business portfolios, CIHR provides leadership and support to over 15,000 world-class researchers and trainees from all pillars of health research and from all regions of Canada.

Organizational Structure

CIHR is led by a President and a Governing Council comprised of up to 18 members appointed by Order in Council. The Governing Council sets the overall strategic direction and goals and establishes health research institutes and determines the mandate of each. As outlined in the legislation, the Governing Council is responsible for developing CIHR’s strategic direction and goals; evaluating its performance, approving its budget; establishing a peer review process for research proposals submitted to CIHR; approving funding for research; approving other expenditures to carry out its objective; establishing policies; and dealing with any other matter that the Governing Council considers related to the affairs of CIHR.

The Access to Information and Privacy (ATIP) Office, part of the CIHR’s Strategic Policy Division, administers the provisions of the Access to Information Act and the Privacy Act for the CIHR and is accountable to the President of CIHR. The ATIP Compliance Office, which is comprised of one ATIP Manager, one Senior ATIP Analyst and one Junior ATIP Officer. In addition, in 2023-2024, CIHR engaged the services of one consultant. The ATIP Office is responsible for the following activities:

• managing all response to both formal and information requests made under both Acts;
• developing policies, guidelines and procedures with respect to fulfilling the Agency’s legislative requirements of both acts;
• promoting awareness of both acts, delivering training, and providing advice and guidance to ensure that employees and management understand their roles and responsibilities;
• monitoring compliance with both acts;
• participating in and contributing to the broader ATIP community of practice;
• preparing annual reports for tabling; and,
• updating the CIHR Info Source chapter annually.

CIHR was not party to any service agreements under section 73.1 of the Privacy Act during the 2023-2024 reporting period.

Delegation of Authority

The President of CIHR, as designated Head of CIHR under the Access to Information Act, exercises powers entrusted to the position by the Act, such as exemptions and exclusions.

In accordance with her authority under Section 73, the President has designated the Executive Vice-President; the Associate Vice-President, Government and External Relations; the Director General, Strategic Policy; the ATIP Manager, the Senior ATIP Analyst and the Junior ATIP Officer to exercise his powers, duties or functions under the Act (See Appendix A - Delegation Order).

Highlights of the Statistical Report 2023-2024

CIHR collects and manages a great deal of personal information to adjudicate thousands of research grant and scholarship proposals, making merit-based awards based on peer review.

a. Formal Requests

During the April 1, 2023 to March 31, 2024 reporting period, CIHR received eight requests under the Privacy Act. One request was outstanding from the previous reporting period. Eight requests were closed during the fiscal year and one request was carried over to the next fiscal year. Of the eight requests completed, four were completed within the first 30 days of reception, two requests were completed within 61 – 120 days, one request was completed in 121 – 180 days and one request was completed in 181 – 365 days. Six requests were disclosed in part and two requests resulted in no records. (See Appendix B - Statistical Report). A total of 10,562 pages were processed and 2,366 pages were released. This is a significant increase from the previous reporting period when a total of 848 pages were processed and 657 pages were disclosed. During this period, 50% of the requests (4) were processed within the legislated time limit. The four requests that were not closed within legislated timelines were due to workload and complexity of the records. The number of requests processed with pages released to requesters over the past five years has fluctuated between two and eleven and the volume of pages processed has fluctuated from 360 pages in 2020-2021 and 10562 in 2023-2024.

b. Informal Requests

In 2023-2024, CIHR responded to more than 60 informal requests, all of which were received internally by CIHR employees. CIHR did not receive any informal requests from external sources, as reported in the Statistical Reports in Appendix B.

Over the past five years, there has been a consistent increase in the volume of internal informal requests that have been made. All of the informal requests received during the 2023-2024 reporting year came from business units related to the review of corporate documents and interpretation of the Privacy Act, primarily related to program and service delivery. These requests are not reflected in the statistical report in Appendix B.

c. Requests for Correction of Personal Information

During the 2023-2024 reporting period, CIHR did not receive any requests for correction of personal information.

d. Consultations

During the 2023-2024 reporting period, the CIHR Access to Information and Privacy Office did not receive any consultation requests from external sources.

CIHR managers and staff sought and obtained advice from the ATIP Coordinator on a regular basis for matters where there were privacy considerations in their programs or activities. In 2023-2024, CIHR contributed to the review and development of many new privacy notices. In-depth and ongoing reviews of corporate practices were conducted with significant support and input from the Access to Information and Privacy office.

e. Costs

During 2023–2024, the Access to Information and Privacy Office incurred $148,493 in salary costs to administer the Privacy Act. Owing to the difficulty of tracking all the operational costs related to the administration of the Act, the costs and human resource statistics are conservative estimates. Almost all costs are attributable to salary and include fractions of the salaries of the Deputy Directors and team leads who participated in work related to the Act.

Training Activites

During the 2023-2024 fiscal year, the development of new and updated ATIP training resources was prioritized. A total of five information sessions were held with management and senior leadership to solicit feedback and seek endorsement of the proposed training plan. These discussions determined the need for enhanced agency-wide training to ensure employees of CIHR are aware of the policies, procedures and their legal responsibilities under the Act. In addition, the ATIP office in consultation with individual business units identified a need for targeted training materials to support the successful administration of core business activities. A training plan and supporting materials were developed in response to the feedback received throughout the year, to be implemented in the 2024-2025 fiscal year.

Policies, Guidelines and Procedures

While there were no significant revisions to current access to information policies, guidelines or procedures, CIHR dedicated time to reviewing efficiencies in the collection use and disclosure of personal information processes.

Initiatives and Projects to Improve Privacy

CIHR continues to develop its activities related to Privacy Act compliance, including the incorporation of privacy provisions within national and international project agreements which involve the collection, use and disclosure of personal information. CIHR continues to ensure that activities including stakeholder engagement, outreach and recruitment are compliant with privacy directive and policies and that any privacy risks are identified and mitigated.

Complaints and Investigations

CIHR did not receive any privacy complaints during the reporting period. One complaint had been carried over from the 2022-2023, reporting year which was completed, and no action was required.

Material Privacy Breaches

No material privacy breaches occurred during the reporting period.

Privacy Impact Assessments

In 2023-2024, CIHR did not conduct any Privacy Impact Assessments (PIAs).

Public Interest Disclosures

CIHR did not make any public interest disclosures under Subsections 8(2) and 8(5) of the Privacy Act during the reporting period.

Monitoring Process

The ATIP Office monitors the trends and time to process requests and administer the Privacy Act. This includes providing performance reports on the status of the branch on a regular basis. Issues of significant interest are discussed with the Director General of Strategic Policy and the Associate Vice President of Government and External Relations, and briefing is provided to the President and Communications department on an as needed basis.

Date modified:

2024-10-10