Streamline Requests for Personal Information (CA0043)

Streamline Requests for Personal Information Why do this: Transparency includes providing Canadians with timely access to their own personal information held by government. How will it be done: To make it easier for Canadians to access government information, including their personal information, the Government will create a simple, central website where Canadians can submit requests to any government institution. This will be backed up with a 30-day guarantee for personal information requests: should a request take longer than 30 days to fulfill, it is proposed that the Government will provide a written explanation for the delay to the requester and to the Privacy Commissioner.

2. Streamline Requests for Personal Information

Commitment Text:

The Government of Canada will make it easier for Canadians to access their own personal information held by government.

Milestones:

2.1. Develop a central website where Canadians can submit personal information requests to any government institution, with first phase of roll-out targeted for 2018.

2.2. Implement a 30-day guarantee for requests for personal information, backed by a commitment to provide a written explanation to the requester and the Privacy Commissioner should a request take longer than 30 days to fulfill.

Responsible institution: Treasury Board of Canada Secretariat

Supporting institution(s): N/A

Start date: Not specified

End date: Not specified

Editorial Note: The text of the commitment was abridged for formatting reasons. For full commitment text, visit: http://www.opengovpartnership.org/wp-content/uploads/2001/01/Canada_AP3.pdf.

Context and Objectives

Canadians requesting personal information held by the government are faced with a challenging process, since it can be difficult to determine the appropriate agency to approach, and at the outset of the action plan only a minority of institutions allowed requests to be filed online. This commitment aims to improve this process by developing a centralized website for submitting personal information requests and implementing a 30-day guarantee for responses. The milestones are reasonably specific, though some details about submitting requests through the new centralized website still require clarification. The centralization of the requesting process, along with expediting wait times, could be a significant improvement for requesters. However, conversations with the Office of the Privacy Commissioner illustrated a strong need for better engagement and communication in taking this commitment forward.[Note17: Conversation by phone on 5 October 2017. ]

Completion

There has been limited progress in implementing Milestone 2.1. The government’s self-assessment report states that the Treasury Board of Canada Secretariat has identified business requirements for the website and completed usability testing for the Access to Information and Privacy Online Pilot site.[Note18: The draft self-assessment is available at: http://open.canada.ca/en/mtsar/draft-consultation-mid-term-self-assessment-third-biennial-plan-open-government-partnership.]

For Milestone 2,2, the self-assessment reports that the Treasury Board of Canada Secretariat has shared implementation options for the 30-day guarantee for requests for personal information with the Office of the Privacy Commissioner (OPC) and received feedback. This was confirmed, in a limited sense, by the Office of the Privacy Commissioner, though they also expressed confusion regarding the current status of this milestone, and the avenue forward.[Note19: Conversation by phone on 5 October 2017. ] The government’s self-assessment reports substantial progress, but says that the approach still needs to be finalized before implementation can begin. Given that there are approximately 240 institutions subject to the Privacy Act, each of which faces their own unique technical and operational challenges, an assessment of substantial progress would require the government to have at least reached the implementation phase. An assessment of limited progress seems more appropriate for Milestone 2.2.

Significant challenges remain for full implementation of both milestones. As such, this commitment does not appear to be on schedule for completion.

Next Steps

During stakeholder consultations, the Canadian Association of Journalists noted that centralizing and simplifying the system was a positive step.[Note20: Toronto consultation, 15 September 2017.] This sentiment was generally echoed by the Office of the Privacy Commissioner.[Note21: Conversation by phone on 5 October 2017. ] However, both the Office of the Privacy Commissioner and the Canadian Association of Journalists noted that the system for responding to personal information requests was substantially under-resourced across the federal government, a systemic problem which will hinder the potential impact of this commitment. Both also expressed a need for more structural reform, including revamping the personal information bank system[Note22: Personal information banks are descriptions of the personal information that a government institution controls, along with information about how the data is collected, used, disclosed, retained and disposed.] as well as the Privacy Act as a whole.

Other stakeholders, including the Centre for Law and Democracy and Fred Vallance-Jones of the University of King's College, proposed that the centralized portal should be extended to receive requests under the Access to Information Act, as well as requests for personal information.[Note23: Halifax consultation, 12 September 2017.] It is worth noting that Mexico’s Infomex website, which has been online since 2008, allows users to not only send requests across the federal executive branch, the Supreme Court and several states and municipalities, but also to appeal agency decisions and consult every request and public response ever processed electronically by the government.[Note24: The Infomex website is available at: https://www.infomex.org.mx/gobiernofederal/home.action.] Although not included in the action plan, Canada’s self-assessment indicates that this is actually being contemplated. The IRM researcher recommends that Canada consider taking this idea forward to create a central system for requests under the Access to Information Act.

2. Streamline Requests for Personal Information

Commitment Text: The Government of Canada will make it easier for Canadians to access their own personal information held by government.

Milestones:

2.1. Develop a central website where Canadians can submit personal information requests to any government institution, with first phase of roll-out targeted for 2018.

2.2. Implement a 30-day guarantee for requests for personal information, backed by a commitment to provide a written explanation to the requester and the Privacy Commissioner should a request take longer than 30 days to fulfill.

Responsible institution: Treasury Board of Canada Secretariat

Supporting institution(s): N/A

Start Date: Not specified

End Date: Not specified

Editorial Note: The text of the commitment was abridged for formatting reasons. For full commitment text, visit http://www.opengovpartnership.org/wp-content/uploads/2001/01/Canada_AP3.pdf.

Commitment Aim

This commitment aimed to simplify and expedite the process for filing a request for disclosure of personal information that a government body holds about the requester. It proposed developing a centralised website for submitting requests and implementing a 30-day guarantee for responses. It would require the government to provide a written explanation to the requester and the privacy commissioner if response times ran longer than 30 days.

Status

Midterm: Limited

The midterm assessment identified significant challenges for completion of each milestone. For the centralised website (2.1), the Treasury Board of Canada Secretariat had identified business requirements and completed usability testing. However, it had not commenced any form of public piloting of the site.[Note8: This is according to the 2017 midterm self-assessment report, which can be accessed at https://open.canada.ca/en/commitment/mtsar/2016-2018.] For the 30-day guarantee, the Treasury Board of Canada Secretariat had shared implementation options with the Office of the Privacy Commissioner. However, it had not commenced concrete steps toward implementation. The Office of the Privacy Commissioner expressed confusion regarding how to move forward. The midterm assessment judged that this commitment was not on schedule for completion.

End of term: Substantial

The government's end-of-term self-assessment reports that the centralised website is still under development, with rollout planned for fall 2018.[Note9: The self-assessment is available at https://open.canada.ca/data/en/dataset/9da9faf5-deb1-48db-8f16-91055d942d65.] The central website will incorporate a functionality for filing both access to information and personal information requests, which was one of the recommendations mentioned in the 2017 midterm assessment. In discussions with the IRM researcher, representatives from the Treasury Board of Canada Secretariat (TBS) attributed the delay to time taken for further site improvements after a first round of usability testing. Feedback from the testing had suggested improvements to the tool's interface.

In June 2018, the president of the TBS issued the “Directive on Personal Information Requests and Correction of Personal Information.” As of 1 October 2018, that directive requires institutions to provide a written explanation to the requester when a request for access to personal information takes more than 30 days to fulfil. The body also must give more detail on the reasons for extensions in the institution's annual report to Parliament.[Note10: The directive is available at https://www.tbs-sct.gc.ca/pol/doc-eng.aspx?id=32590&section=html.] Canada's end-of-term self-assessment states that the TBS encourages institutions to begin implementing this directive earlier than October. However, since the milestone calls for the implementation of the 30-day guarantee within the action plan two-year cycle—and this deadline extends beyond that time—the milestone is coded as having substantial progress.[Note11: The self-assessment is available at https://open.canada.ca/data/en/dataset/9da9faf5-deb1-48db-8f16-91055d942d65.]

Did It Open Government?

Access to Information: Marginal

Canadians requesting personal information held by the government face challenges in determining the appropriate agency to approach, as well as delays in receiving their information. This commitment aimed to improve this process by centralising it and expediting timelines for response. Although the first milestone has the potential to be a major step forward, it was not completed during the action plan.

For the second milestone, the language of the directive could represent important progress by improving the accountability for departments which fail to meet the 30-day timeline. However, its full implementation will not occur until well after the conclusion of the action plan.

As a result, while this commitment has the potential to have a moderately positive impact, its outcomes thus far are assessed as marginal. The coding would have been higher had the commitment been completed.

Carried Forward?

The first milestone of this commitment was carried forward. Canada's fourth action plan includes an expansion of the Access to Information and Privacy Online Request Service to 50 new institutions in each year of the action plan.