ARCHIVED – Annual Report on the Privacy Act 2018–2019

Annual Report on the Privacy Act 2018–19 [PDF 3497 KB]

ISSN 2561-7753 (Print)
ISSN 2561-7761 (Online)

Copyright/Permission to Reproduce

About the National Energy Board

The National Energy Board is an independent federal regulator of several parts of Canada’s energy industry. It regulates pipelines, energy development and trade in the public interest with safety as its primary concern. The Minister of Natural Resources is responsible for this organization.

The National Energy Board (NEB or the Board) was established by Parliament to regulate, among other things, the construction, operation and abandonment of pipelines that cross provincial or international borders; international power lines and designated interprovincial power lines; imports of natural gas and exports of crude oil, natural gas liquids, natural gas, refined petroleum products, and electricity; and oil and gas exploration and production activities in certain areas. The NEB is also charged with providing timely, accurate and objective information and advice on energy matters.

For more information about the NEB please visit our website.

The Privacy Act

The Privacy Act (the Act) gives individuals the right of access to information about themselves held by the federal government, with certain specific and limited exceptions. The Act protects an individual's privacy by setting out provisions related to the collection, retention, use and disclosure of personal information.

In accordance with section 72 of the Act, the head of every federal institution is required to submit an Annual Report to Parliament on the administration of the Act following the close of each fiscal year. The Annual Reports are then tabled in Parliament pursuant to section 72 of the Act. This report describes how the National Energy Board (NEB) fulfilled its privacy responsibilities during the fiscal year 2018–19

Tabling of the annual report

This annual report is prepared and is tabled in Parliament in accordance with section 72 of the Act.

1. Statistical Report and Interpretation

I. Requests received under Privacy Act

In 2018–19, the NEB received two requests under the Act. This is a notable decrease as the NEB received nine requests in the previous reporting period.

• 
  Source and Description:

  Source:
  NEB – Annual Report on the Privacy Act 2018-19

  Description:
  This graph shows the number of requests received during reporting periods from 2014-15 to 2018-19. The NEB received two requests under the Act, a notable decrease as the NEB received nine requests in the previous reporting period.

II. Costs

During 2018–19, the NEB Access to Information and Privacy (ATIP) Office incurred $22,956 in salary costs and $0 in goods and services costs to administer the Act.

Despite the decrease in requests completed from the previous year, the level of effort increased as the number of pages nearly tripled. Accordingly, costs associated with privacy requests also increased by a factor of three.

See annex A for further statistical information.

2. Practices and procedures

I. NEB Structure

Privacy requests at the NEB are processed by the ATIP Office, which reports to the Vice President (VP), Data and Information Management, as the ATIP Coordinator.

Privacy requests are now received primarily through two channels; through the mail or the ATIP Online Request Service (AORS), which was established in late 2018. Requests received through the mail are logged into the NEB’s records management system by the Information Management & Architecture Team’s Records department and then forwarded to the ATIP Office.

The NEB was among the first departments to onboard to the AORS. Neither of the privacy requests submitted to the NEB in 2018-19 were received via this new service. However, if they were sent in through the AORS, the requests would be received by the NEB’s Records Team, logged into our records system, and forwarded to the ATIP Office for processing.

As of the end of 2018-19, the NEB has 5 fulltime employees, who allocate a portion of their time to activities related to the Act. This includes one Senior ATIP Officer, three ATIP Officers, and a Director.

II. NEB ATIP Training

Training was a significant area of focus for the NEB’s ATIP Office this year.

In addition to promoting privacy awareness through in-person meetings, and online training, the ATIP Office also delivered a number of well-received internal presentations on ATIP as part of its training program.

During 2018-19, the NEB continued to require that all NEB staff and contractors successfully pass the Access to Information and Privacy Fundamentals – I015 course offered by the Canadian School of Public Service (CSPS). During this reporting period, 54 NEB employees registered for the course with 44 employees completing it successfully.

Training on the Access to Information Act and the Privacy Act was also offered by the ATIP Office which delivers both specialized training to respond to the needs of officers and clients, and general training to raise employees’ awareness of their responsibilities under these Acts. In this regard, the NEB reviewed its ATIP training materials (i.e. tasking email, PowerPoint presentation, ATIP Tips Sheet, etc.) towards improving its training and communications with NEB leadership and staff.

Specifically, new materials were developed, which aimed to better connect the legislation with the day-to-day work of employees. This was achieved by providing practical examples of typical NEB documents to staff, and showing them how the Act applies in different circumstances. Extended Q&A sessions with staff helped reinforce the information conveyed, and demonstrated the level of interest in understanding this information.

The ATIP Office anticipates that increased awareness of the Act amongst employees will improve their ability to collect records, help them better identify information for potential redaction, and enable them to better support the ATIP Office’s processing of requests. The ultimate goal being release packages that are responsive to requesters.

Training also focused heavily on employees’ obligations under the Privacy Act with respect to protection personal information. This was a considerable focus area for the ATIP Office this year, in light of an uptick in privacy breaches. In this regard, the NEB also reviewed its internal privacy breach procedures and practices to ensure NEB staff are aware of their obligations in the event of a privacy breach. The NEB has adopted TBS’ privacy breach management procedures, and utilizes the available suite of tools to assist in managing breaches.

For 2019-20, the ATIP Office is planning additional activities to raise awareness around ATIP and best practices, all towards improving the NEB’s processing of requests. These activities will build on the NEB’s previous “ATIP Tip of the Week” campaign, which started in 2016-17, where each week a new ATIP tip was posted on the screensavers of all NEB staff. New screensaver tips have been developed and will be rolled out later this year. The NEB looks forward to reporting on these activities in next year’s report.

The NEB’s ATIP Officers received training by attending conferences/webinars offered by the Treasury Board‘s Information and Privacy Policy Department, as well as attending the Canadian Access and Privacy Association yearly conference held in Ottawa in November 2018. The ATIP Office also participated in this year’s Right to Know week.

III. NEB Policies

Documentation and training materials on the NEB ATIP program are being updated and will be made available through the corporate intranet, along with links to other materials, such as the Acts, Treasury Board Secretariat policies and guidance documents, and a range of information management and guidance tools.

The NEB adopted Treasury Board’s privacy breach management guidelines and is actively exploring opportunities to further integrate this approach into the NEB’s processes. Other potential policy and process improvements are actively being explored that will support the ATIP Office in carrying out its mandate, and it is anticipated that several policies will be finalized over the next fiscal year. This includes drafting a not-as-yet approved policy on email management, as well as add-ons to the breach management policy.

The NEB continued to examine its ATIP procedures this year. This was an effort to enable continuous improvement and to identify opportunities for efficiencies in processing access to information and privacy requests

3. Delegation of authority

The Governor in Council has designated the NEB Chair and CEO with the authority to exercise the powers, duties and functions of the Act. The Chair and CEO has historically delegated this authority.

Due to changes in leadership structure at the NEB, the ATIP Office was relocated under the VP, Data and Information Management. In the interim, the VP, Projects, oversaw two business units and retained delegated authority while a competitive staffing process was completed for the VP, Data and Information Management position. After an initial orientation period, authority was permanently delegated to the VP, Data and Information Management, as designed.

This year, the Chair and CEO took steps to increase operational efficiency, improve the Board’s ability to respond to ATIP requests in a timely manner, and minimize disruption to the exercising of this authority. Under the current set of orders, there are now three individuals that have been delegated full authority under the Act, instead of the previous one. They are: the VP, Data and Information Management (primary ATIP Coordinator), and the VP, Projects and Director, Access to Information and Privacy (alternate ATIP Coordinators). From an operational standpoint, granting this authority to three individuals ensures that files can be reviewed and signed-off on without undue delay.

See annex C for a copy of the delegation orders.

4. Complaints and appeals to the Federal Court

During 2018–19, there was one new complaint registered with the Office of the Privacy Commissioner. As always, the NEB will continue to work closely with the Office of the Privacy Commissioner to resolve complaints in a timely and efficient manner.

No appeals were made to the Federal Court of Canada during 2018–19.

5. Privacy Impact Assessments

During the 2018-19 reporting period, no privacy impact assessments were completed.

The NEB posts summaries of completed privacy impact assessments on its external website and forwards copies of completed assessment reports to the Office of the Privacy Commissioner.

6. Disclosure under paragraphs 8(2)(e) or (m) of the Privacy Act

The NEB did not disclose any personal information under paragraphs 8(2)(e).

Due to an extreme and unforeseen circumstance, there was one disclosure made under section 8(2)(m) of the Act during the reporting period. The NEB formally notified OPC of this disclosure in a letter following the authorization of release under this section of the Act.

7. Privacy breaches

There were seven privacy incidents reported to the NEB’s ATIP Office during 2018-19. This is up from one incident in the prior year. These instances included six incidents where emails containing personal information (i.e. offer letters, training requirements, personal leave data) were either sent to the wrong address, were not received by the intended recipients, or were disclosed without proper authorization. The seventh incident involved the theft of an NEB emergency communications package, which contained contact lists for NEB employees and external parties, from an employee’s personal vehicle. In the case of theft, the employee advised both local law enforcement, as well as the NEB’s ATIP Office and Security Team.

In all instances, the ATIP Office applied the Treasury Board’s breach management procedures and worked with the relevant Office of Primary Interest and ATIP Coordinator to identify and implement administrative measures to mitigate the potential for future incidents (e.g. two-person verification of email addresses, ensuring emails sent to multiple recipients use the bcc line). Overall, these incidents have helped the NEB improve its handling and classification of personal information, as well as its information management practices.

The NEB’s ATIP Office has also made considerable effort to raise the level of awareness on our obligations to protect personal information. This heightened awareness is a likely contributor to the increased reporting. While we have room to improve, the NEB is taking this as a considerable opportunity to further strengthen our collection, handling, storage, and transmission procedures around personal information. To this end, the ATIP Office is actively exploring ways to integrate Corporate Security requirements and information management practices towards a more comprehensive suite of training, training materials, and information products. The NEB’s objective is to both minimize unauthorized disclosures and continually improve in our management of privacy breaches when they occur.

8. Compliance

The NEB achieved a compliance rating of 100% for completed privacy requests closed within the legislated timeframe in 2018–19.

For requests closed during the reporting period, the NEB processed a total of 1079 pages and disclosed 947 pages to requesters. This represents a 179-percent increase in the number of pages processed when compared to the previous fiscal year.

With regards to the timeliness of processing privacy requests, the ATIP Office regularly communicates progress updates to the ATIP Coordinator through the ATIP Director. The ATIP Director receives weekly updates from the ATIP Office regarding the status of all active requests, and has access to a central tracker that is updated on a regular basis to establish action items or flag upcoming due dates.

• 
  Source and Description:

  Source:
  NEB – Annual Report on the Privacy Act 2018-19

  Description:
  This graph shows the number of pages processed for requests closed during reporting periods from 2014-15 to 2018-19. The NEB processed a total of 1079 pages and disclosed 947 pages to requesters.

Annex A – Statistical Report on the Privacy Act

Statistical Report on the Privacy Act

Name of institution: National Energy Board of Canada

Reporting period: 2018-04-01 to 2019-03-31

Part 1: Requests Under the Privacy Act

Part 2: Requests Closed During the Reporting Period

2.1 Disposition and completion time

2.2 Exemptions

2.3 Exclusions

2.4 Format of information released

2.5 Complexity

2.5.1 Relevant pages processed and disclosed

2.5.2 Relevant pages processed and disclosed by size of requests

2.5.3 Other complexities

2.6 Deemed refusals

2.6.1 Reasons for not meeting statutory deadline

2.6.2 Number of days past deadline

2.7 Requests for translation

Part 3: Disclosures Under Subsections 8(2) and 8(5)

Part 4: Requests for Correction of Personal Information and Notations

Part 5: Extensions

5.1 Reasons for extensions and disposition of requests

5.2 Length of extensions

Part 6: Consultations Received From Other Institutions and Organizations

6.1 Consultations received from other Government of Canada institutions and other organizations

6.2 Recommendations and completion time for consultations received from other Government of Canada institutions

6.3 Recommendations and completion time for consultations received from other organizations

Part 7: Completion Time of Consultations on Cabinet Confidences

7.1 Requests with Legal Services

7.2 Requests with Privy Council Office

Part 8: Complaints and Investigations Notices Received

Part 9: Privacy Impact Assessments (PIAs)

Part 10: Resources related to the Privacy Act

10.1 Costs

10.2 Human Resources

Note: Enter values to two decimal places.

In addition to completing the forms for the statistical reports for the Privacy Act for 2018-19, institutions were required to report separately on the application of two new exemptions added to the Privacy Act. These exemptions are set out in the table below:

Privacy Act

Appendix B – Statistical information (French)

Appendix C – Delegation Orders

Privacy Act Designation Replacement Order

The Chair and CEO of the National Energy Board (the Board), pursuant to Section 73 of the Privacy Act (the Act) hereby replaces the Privacy Act Designation Order made on the first day of September, 2016, at the City of Calgary, in the Province of Alberta by the following text.

The Chair and CEO of the Board, pursuant to Section 73 of the Privacy Act^{Note 1} hereby designates the person holding the position of Vice President, Projects to exercise the powers and perform the duties and functions of the Chair and CEO as head of a government institution under the Act.

Date at the City of Calgary, in the Province of Alberta, this 6^th day of November 2017.

______________________________
Peter Watson
Chair and CEO

Privacy Act Designation Replacement Order

The Chair and CEO of the National Energy Board (the Board), pursuant to Section 73 of the Privacy Act (the Act) hereby replaces the Privacy Act Designation Order made on the sixth day of November, 2017, at the City of Calgary, in the Province of Alberta, by the following text.

The Chair and CEO of the Board, pursuant to Section 73 of the Privacy Act^{Note 2} hereby designates the person holding the position of Vice President, Data and Information Management to exercise the powers and perform the duties and functions of the Chair and CEO as head of a government institution under the Act.

Dated at the City of Calgary, in the province of Alberta, this 9^th day of April 2018.

______________________________
Peter Watson, P.Eng., FCAE
Chair and CEO

Privacy Act Designation Replacement Order

The Chair and CEO of the National Energy Board (the Board), pursuant to Section 73 of the Privacy Act (the Act) hereby replaces the Privacy Act Designation Order made on the ninth day of April, 2018, at the City of Calgary, in the Province of Alberta, by the following text.

The Chair and CEO of the Board, pursuant to Section 73 of the Privacy Act^{Note 3} hereby designates the person holding the position of Vice President, Projects to exercise the powers and perform the duties and functions of the Chair and CEO as head of a government institution under the Act.

Dated at the City of Calgary, in the province of Alberta, this 25^th day of July 2018.

______________________________
Peter Watson, P.Eng., FCAE
Chair and CEO

Delegation of Authority pursuant to the Access to Information Act and the Privacy Act

I, the Chair and CEO of the National Energy Board (the Board), pursuant to Section 73 of the Access to Information Act ^{Note 4} and section 73 of the Privacy Act^{Note 5} , hereby designate the persons holding the positions set out in the Delegation of Authority Schedule attached hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Chair and CEO of the National Energy Board under the provisions of the Acts and related regulations set out in the schedule opposite each position. This designation supersedes all previous delegation orders.

Dated at the City of Calgary, in the Province of Alberta, this 17^th day of December 2018.

______________________________
Peter Watson, FCAE
Chair and CEO

Delegation of Authority Schedule

Date modified:

2023-11-27