2024-2025 Annual Report to Parliament on the Privacy Act

1. Introduction

The Privacy Act provides Canadian citizens and people present in Canada the right of access to, and correction of, information about them that is held by the federal government. It also protects against unauthorized disclosure of that personal information. In addition, it strictly controls how the government will collect, use, store, disclose, and dispose of any personal information.

This report summarizes the activities of the Canadian Northern Economic Development Agency (CanNor) in implementing the Act, for the period of April 1, 2024 to March 31, 2025, and fulfills the requirement under Section 72, which stipulates that the head of every government institution shall prepare for submission to Parliament an annual report on the administration of this Act within the institution during each financial year.

2. Mandate

CanNor works with partners to advance economic development in Canada's territories. Through its grants and contributions programming, the Agency supports, invests in and advocates for national, territorial and community level economic development; fosters growth and innovation; contributes to building capacity; and invests in foundational economic development projects in the territories.

CanNor's Northern Projects Management Office coordinates federal participation in the territorial environmental review processes and maintains the Crown consultation record for major projects.

In addition, CanNor hosts Pilimmaksaivik, the Federal Centre of Excellence for Inuit Employment in Nunavut. The Centre is responsible for coordinating a whole of government approach to building a representative federal public service in Nunavut, as described in Article 23 of the Nunavut Agreement.

The Agency works closely with all federal partners to advance a whole of government approach to economic development in the territories.

3. Organizational Structure

For the purposes of the Privacy Act, the President of CanNor has delegated powers, duties and functions under the Act to the Corporate Secretary who performs the role of ATIP Coordinator responsible for leading the ATIP Program. The ATIP Coordinator administers the Act with the assistance of a part-time Administrative Officer. During the reporting period, CanNor was not party to any service agreements under section 73.1 of the Privacy Act.

The ATIP Coordinator is accountable for the development, coordination, and implementation of effective policies, guidelines, systems, and procedures to meet responsibilities under the Act, and to permit processing requests, and disclosure of information. Additionally, the ATIP Coordinator provides strategic support and advice to the executive management of the Agency regarding the administration of the ATIP Program, and is responsible for all privacy activities and operations pursuant to the Act such as:

• processing and responding to all formal requests and interdepartmental consultations under the Privacy Act;
• providing strategic advice to the Agency about privacy-related issues;
• preparing guidance documents in support of privacy legislation;
• updating and registering personal information banks;
• preparing the Annual Report to Parliament on the Privacy Act;
• training employees on their roles and responsibilities under the Privacy Act; and,
• processing and responding to informal inquiries.

4. Delegation Order

The President's Privacy Delegation Order is attached as Annex A and was updated on December 11, 2023. It provides delegated authority to the Corporate Secretary and the Manager, IM/IT and Chief Information Officer.

5. Statistical Report Key Data

CanNor's 2024-2025 Statistical Report on the Privacy Act is attached as Annex B. The following is an overview of key data on CanNor's performance for the fiscal year:

6. Training and Awareness

Formal training was conducted by the ATIP Coordinator during the CanNor Administrative Professionals Annual Training Meeting in February 2025. This session captured all sectors of CanNor and focused on record collection, internal processes, timelines and exemptions. In addition, informal briefings were provided to CanNor Middle Managers on the administration of the Privacy Act. Briefings were conducted one-on-one, as needed, via in person or online video meetings and telephone calls.

Throughout the reporting period, the ATIP Coordinator provided ongoing advice on privacy related matters, as required. Additionally, guidelines and procedures are provided to employees and management.

7. Policies, Guidelines and Procedures

CanNor did not implement or amend any institution-specific Privacy policies, guidelines, or procedures during the reporting period. The Agency did not receive authority for any new collections or new consistent uses of Social Insurance Numbers during the reporting period.

8. Initiative and Projects

In addition to providing enhanced training to employees and managers on implementing the Privacy Act, the Agency actively employs TBS approved technological tools, to efficiently process requests.

9. Actions taken on Complaints or Audits

There were no complaints received concerning the administration of the Privacy Act, and no audits, investigations, or appeals to the Federal Court were undertaken.

10. Material Privacy Breaches

CanNor reported no internal material privacy breaches to the Office of the Privacy Commissioner during the 2024-2025 reporting period.

The CanNor ATIP Coordinator was advised by the Treasury Board Secretariat (TBS) of two specific large scale material privacy breaches within third party delivery agents of the government. As a result, the Agency participated in information sessions, the dissemination of notices to employees, and activated the CanNor privacy breach response committee to evaluate potential impact and required processes as directed by TBS regarding the external to CanNor privacy breaches.

11. Privacy Impact Assessments

During the reporting period, CanNor did not complete any Privacy Impact Assessments and no assessments were forwarded to the Office of the Privacy Commissioner.

12. Public Interest Disclosures

There were no disclosures pursuant to paragraph 8(2)(m) for the 2024-2025 period.

13. Monitoring Compliance

As the official responsible for completion timelines, the ATIP Coordinator is made aware of new and outstanding requests on a continual basis. A shared request database is used when processing Privacy requests, which tracks deadlines and allows for effective monitoring. Response rates are monitored on an ongoing basis to ensure responses are within allowable periods.

A weekly report is provided to the Minister's Office and the President's Office listing the number of active requests, the number of new requests received, the status of each request and the estimated release dates. The President, Vice Presidents, and/or Directors General are notified as appropriate.

Annex A – Delegation Order under the Privacy Act

Pursuant to the powers of designation conferred upon me by Section 73(1) of the Privacy Act, the persons exercising the functions or positions of Manager, IM/IT and Chief Information Officer (position number 000139900), and Corporate Secretary (position number 146270) and their respective successors, including in their absence, a person or officer designated in writing to act in the place of the holder of any such functions or positions are hereby designated to exercise those powers, duties or functions of the President as the Head of the government institution under the Act, and as set out in Schedules A and B.

President - Canadian Northern Economic Development Agency
Dated at Ottawa, the 11th of December, 2023

Annex B - Statistical Report on the Privacy Act

Reporting period: April 1, 2024 to March 31, 2025