Annual Report to Parliament on the Administration of the Privacy Act — April 1, 2023 – March 31, 2024

Contents

• 1. Introduction
  • 1.1 About Agriculture and Agri-Food Canada
  • 1.2 Purpose of the Privacy Act
• 2. Organizational structure
  • 2.1 Governance
  • 2.2 Privacy Compliance Unit — mandate and organizational structure
• 3. Delegation of authority
• 4. Performance
  • 4.1 Overview
  • 4.2 Privacy compliance
  • 4.3 Privacy Act performance and statistics for 2023–2024
• 5. ATIP training and awareness
  • 5.1 Departmental privacy training
  • 5.2 Awareness
• 6.0 Privacy policies, guidelines and procedures
  • 6.1 Privacy policy
  • 6.2 Guidelines and procedures
• 7. Initiatives and projects to improve privacy
  • 7.1 Innovation and client service
  • 7.2 Generic Privacy Impact Assessment for grants and contributions programs at AAFC
• 8. Summary of key issues and actions taken on complaints
• 9. Material privacy breaches
• 10. Privacy Impact Assessments
  • 10.1 Telematics Privacy Impact Assessment
• 11. Public interest disclosures
• 12. Monitoring compliance
• 13. Conclusion
• 14. Annex A — Privacy Act designation order, Agriculture and Agri-Food Canada
• 15. Annex B — Delegation of authority instrument for the administration of the Privacy Act
• 16. Annex C — Statistical report on the Privacy Act

1. Introduction

The Department of Agriculture and Agri-Food Canada (AAFC) presents to Parliament its Annual Report on the Administration of the Privacy Act for fiscal year April 1, 2023 to March 31, 2024. This report is prepared and tabled in accordance with section 72 of the Privacy Act and section 20 of the Service Fees Act.

In accordance with the Treasury Board of Canada Secretariat (TBS) requirements, this report provides an overview of the activities of AAFC in administering its responsibilities under the Privacy Act.

AAFC’s Access to Information and Privacy (ATIP) Office is responsible for the administration of Access to Information and Privacy Acts and related matters within the department. The department is committed to openness and transparency, making every reasonable effort to assist Canadians to access records held within AAFC — while protecting privacy, security and confidentiality.

AAFC did not have any non-operational (“paper”) subsidiaries during this reporting period.

1.1 About Agriculture and Agri-Food Canada

AAFC supports the Canadian agriculture and agri-food sector through initiatives that promote innovation and competitiveness. The department provides information, research and technology, policies, and programs to help Canada’s agriculture, agri-food, and agri-based product sectors compete in markets at home and abroad, manage risk, and embrace innovation.

The activities of the department extend from the farmer to the consumer, from the farm to global markets, through all phases of sustainably producing, processing, and marketing of agriculture and agri-food products.

1.2 Purpose of the Privacy Act

The purpose of the Privacy Act is to protect the privacy of individuals with respect to their personal information. This Act governs the federal government’s collection, retention, use and disclosure of that information. It also provides individuals with a right of access to their personal information.

2. Organizational structure

2.1 Governance

Administration of the Access to Information Act (ATIA) and the Privacy Act (collectively referred to as “the Acts”) is the primary responsibility of the AAFC ATIP Office, which is part of the department’s Public Affairs Branch (PAB). The ATIP Office processes all requests for information and coordinates all activities related to the Acts, along with associated regulations, directives, and guidelines.

The ATIP Office consists of two units — the Operations Unit and the Privacy Compliance Unit (PCU). The Operations Unit works closely with AAFC officials to process ATIP requests; while the PCU supports and advises AAFC officials on privacy-policy related matters, such as compliance measures, privacy evaluations and Privacy Impact Assessments (PIA), and general inquiries regarding the collection and use of personal information.

2.2 Privacy Compliance Unit — mandate and organizational structure

The ATIP PCU provides advisory services related to privacy policy and privacy protection for departmental activities. It also provides advisory services for the various Grants and Contribution and Business Risk Management programs developed to support Canada’s agricultural sector and its producers and processors. Specifically, the unit provides advice on matters concerning the collection, use and disclosure of personal information necessary to operate these programs, and offers effective recommendations and strategies for mitigating risks to privacy that may be present.

Responsibilities include:

• providing privacy analysis and advice using several tools, including AAFC’s Privacy Evaluation tool, Privacy Impact Assessments (PIA) and Privacy Protocols;
• developing privacy policies, procedures, and practices;
• delivering privacy training and awareness programs to staff;
• assessing and reporting on privacy breaches;
• coordinating the department's update of Info Source; and
• producing the departmental reporting requirements for the Annual Report to Parliament on the Privacy Act.

The ATIP Operations unit is responsible for the management, monitoring and processing of various request types, including access to information, privacy requests, consultation requests, informal requests, and proactive disclosure. The ATIP Office is comprised of a variety of positions that help to support the mandate and operations of both units within the Office. When fully staffed, these positions include:

• Director (1)
• Manager, Access to Information and Privacy Operations (1)
• Manager, Privacy Compliance (1)
• Senior ATIP Analyst (1)
• ATIP Analysts (3)
• Junior ATI Analyst (2)
• Privacy Analyst (2)
• ATIP Officer (1)
• Administrative Support (1)
• Contractor supporting ATIP Operations full-time (1)
• Contractor supporting Privacy Policy part-time (1)
• Students (2)

The cost of administering the ATIP Office (for privacy matters as recorded in the statistical reports) during the reporting period was $426,992 which included 3.314 full-time employees, 0.362 casual employees and 0.375 student person years (or $381,313 in salaries and $27,297 for professional services).

AAFC does not currently have a service agreement under section 73.1 of the Privacy Act. However, privacy advisory services related to the Dairy Innovation and Investment Fund program, which is administered by the Canadian Dairy Commission on behalf of AAFC, were provided informally.

3. Delegation of authority

Section 73 of the Privacy Act provides for the Minister of AAFC to delegate the powers, duties and functions designated by the Acts.

The delegation of authority for the administration of the Privacy Act includes the PAB Assistant Deputy Minister, the Director General, Communications Services, and the Director of ATIP and Translation Services, who have full delegated authority to approve exemptions in accordance with the delegation of authority instrument approved by the Minister in October 2023. Certain administrative functions, as well as some authority to apply exemptions and approve release packages, are also delegated to the ATIP Managers to enhance efficiency in request processing.

The delegation of authority instrument for the administration of the Privacy Act is appended hereto at Annex A and Annex B.

4. Performance

4.1 Overview

AAFC’s ATIP Office has taken important steps over the past year to continue work responding to a previously commissioned Advisory Audit. Building on the work that was done in the previous fiscal year, the ATIP Office also aligned its priorities with the recommendations from the Treasury Board Secretariat Report to Parliament on the Review of the ATIA to improve access to information and privacy services to Canadians.

In this reporting period, the ATIP Office continued working on priorities addressing three different components — Our People, Our Work and Our Relationships. Over the past fiscal year, these components have included staffing to meet resource needs, continued investment and progression of candidates in the ATIP Analyst Development Program, and continued work preparing for the transition to a new case management system.

4.2 Privacy compliance

Following a significant reorganization, the Privacy Compliance Unit (PCU) was well positioned this fiscal year, to focus efforts on streamlining privacy program evaluation processes, updating privacy policies, and expanding its network across the department to foster more collaboration.

In doing so, improved working relationships were formed; notably, between AAFC Security, Information Services, Human Resources, the Office of the Chief Data Officer and AAFC’s Centre of Excellence for Grants and Contributions programming.

During this time, the PCU has worked with several clients to ensure a “privacy-by-design” approach to new and existing activities, including the launch of AAFC’s first public facing artificial intelligence bot known as AgPal Chat, the development of AAFC’s departmental Data Policy and the establishment of a Generic Privacy Impact Assessment for Grants and Contributions programming.

In addition to policy development, the Privacy Compliance Unit processed 124 files during 2023-2024. Processing the files included providing advice and guidance related to information sharing agreements, digital solutions, the handling, use and disclosure of personal information, and privacy risk assessments of programs, activities, and projects. Compared to a total of 81 files processed last fiscal year, this represents an increase of 53%. Of the 124 files, 48 (38%) were related to new digital solutions being introduced at AAFC, which was nearly three times the number of similar files received last fiscal year. This suggests a significant move for the department towards greater automation in its processes. Additionally, there were 32 privacy breach incidents reported (28% more than last fiscal year), of which two were related to the government-wide BGRS and SIRVA Canada systems, and Canada Life data breaches managed by TBS, 13 were non-material breaches, and 17 were privacy incidents – an event that occurred and was reported, where no breach of personal information was found.

Overall, the increase in these statistics serve as a key indicator that awareness campaigns and training efforts have resulted in greater attentiveness towards privacy protection and management at AAFC, as more employees seek advice, input or report incidents to the Privacy Compliance Unit, each year.

Departmental context for 2023-2024

Fiscal year 2023-2024 has brought new challenges as AAFC adopts an even stronger focus on innovation to drive a profitable, productive, and sustainable agri-food industry that can meet growing global demand for sustainable food.

AAFC has identified priorities that focus on achieving results through initiatives, programs, and services to help create an efficient, sustainable and thriving sector. Efforts will support the delivery of the Minister of Agriculture and Agri-Food’s mandate letter commitments and broader Government of Canada priorities, including in the areas of policy development and program delivery, support for Canada’s food system, sustainable growth, and climate resiliency. 

In 2023-2024, AAFC

• continued working with its partners on the Sustainable Canadian Agricultural Partnership to deliver on sectoral needs in the following areas: trade and expanding markets, innovation and sustainable growth, and the support of diverse and dynamic, evolving sectors; 
• delivered key funding initiatives to agri-sectors across Canada; and 
• continued building on thematic priorities for clean technology programs and innovations, while maintaining industry engagement. 

Adjustments to the mandate surrounding in-office presence for public servants resulted in a different approach to hybrid work arrangements during the reporting period. The ATIP Office worked to equip its employees to work effectively both from home and at the office. Another factor impacting AAFC during this reporting period was the Public Service Alliance of Canada members labour strike during Q1 of 2023-2024. Basic operations continued during the strike and legislated deadlines were impacted as a result of resource constraints.

4.3 Privacy Act performance and statistics for 2023–2024

This section provides an overview of key data on the institution’s performance regarding ATIP Operations as it relates to privacy requests for the year. The information is reflected in the institution’s statistical report for 2023-2024 in Annex C.

Caseload and carry forward

• In 2023-2024, AAFC received a total of 13 privacy requests. 
• Of the 13 total privacy requests received in this reporting period, 10 were closed before March 31, 2024.
• There was one privacy request carried over from 2022-2023, which was also closed in the 2023-2024 reporting period.
• Three requests from 2023-2024 will be carried over to the 2024-2025 reporting period.

Description of the above image

Processing trends for privacy requests, 2020–2021 to 2023–2024

	Outstanding	Received	Completed	Carried forward
2020-2021	0	18	18	0
2021-2022	0	19	18	1
2022-2023	1	10	10	1
2023-2024	1	13	11	3

Description of the above image

Pages processed and disclosed, 2020–2021 to 2023–2024

	Number of pages processed	Number of pages disclosed	Release ratio (%)
2020-2021	9641	1894	19.6
2021-2022	2069	1723	83.3
2022-2023	2983	2919	97.9
2023-2024	10929	4545	41.6

Processing time for requests

• Five requests, or 45%, were completed within 30 days, and six, or 55%, were completed between 31 and 60 days.
• Requests were responded to within required timelines 100% of the time.

Extensions

The Privacy Act allows extensions beyond the 30-day statutory time frame for specific reasons, such interference with operations, volume of records, or required consultations with other government departments (OGDs). For this reporting period, 6 requests required time extensions of up to 30 days owing to the volume of relevant records requiring review.

Consultations completed from other institutions

AAFC must also respond to consultations pursuant to the Privacy Act from other government institutions in order to provide those institutions with recommendations regarding the release of information of interest to AAFC. No requests for consultation were received during the reporting period. 

Disposition of completed requests

Of the 11 privacy requests completed in 2023-2024, 7 were disclosed in part, 2 were fully disclosed and 1 was abandoned by the requester.

Exemptions or exclusions invoked

The appended statistical report provides details regarding the types of exemptions or exclusions applied to information for completed requests.

• For four consecutive years, the most common exemption used by AAFC during the reporting period has been section 26 (personal information about individuals other than the requester).
• No exclusions were invoked during the reporting period.

Translations

• No translations were required to respond to requests in 2023-2024.

Format of information released

• All responsive records were provided to requesters as digital copies using E-post.

5. ATIP training and awareness

5.1 Departmental privacy training

The ATIP Office continues to invest in its people and is focused on enhancing departmental privacy awareness by offering a range of ATIP-related training courses. These offerings ensure that staff and management understand their roles and responsibilities with respect to the Acts and related policies, including closely linked subjects such as information management.

Training

During fiscal year 2023-2024, the Privacy Compliance Unit delivered several virtual privacy training sessions to various groups within AAFC, addressing privacy breach awareness, prevention and management, as well as roles and responsibilities related to the collection and use of personal information. These sessions included training for Human Resources, the Farm Income Programs Directorate and the Administrative Recruitment and Development program. In total, 141 employees attended these virtual training sessions. Moving forward into next fiscal year, the ATIP Office is working to provide on demand training services through its Agri-Campus platform to further support employee training needs.

ATIP Analyst Development Program

The ATIP Office continued to support the development of our employees through the ATIP Analyst Recruitment and Development Program, aimed at expanding opportunities within AAFC-ATIP and retaining talent and expertise within the department. The goal of the program is to have a capable workforce that can grow within the AAFC ATIP Office. Entry-level participants receive training in both ATIP operations and privacy policy and can become eligible for promotion as qualifications and experience are gained over a set period of time.

5.2 Awareness

Right to Know Week

In 2023, Canada, and many other countries around the world, celebrated Right to Know Week from September 25 to October 1. AAFC highlighted events via internal publication to spread awareness about privacy rights and to underline the importance of valuing and protecting personal information. AAFC’s ATIP Office promoted courses available to employees on privacy management and developed several guidance documents on its SharePoint site as helpful resources for AAFC employees.

Employee engagement

An employee engagement plan was designed and began implementation in 2022-2023 and continued into this reporting period. It consists of three areas – updating and implementing the AAFC Employee Training Program, launching an Awareness Campaign and strengthening the network of various AAFC groups (e.g. Officers of Primary Interest (OPIs), Legal, Information Management, etc.). The ATIP Office was successful in the implementation of its Awareness Campaign and strengthened networks across the department.

6.0 Privacy policies, guidelines and procedures

6.1 Privacy policy

The Privacy Compliance Unit continues to revise AAFC’s privacy policy suite where appropriate. A suite of policy tools was developed to help AAFC employees understand their responsibilities with regards to the protection, collection and use of personal information. Included in the policy suite is AAFC’s Privacy Breach Response Plan, Directive on Privacy Impact Assessment, the Social Insurance Directive, and the Privacy Management Framework. These tools are instrumental in ensuring that AAFC employees have the resources available to them to understand their responsibilities in regards to the use and protection of personal information.

6.2 Guidelines and procedures

Building on the work completed in the previous fiscal, the Privacy Compliance Unit continued to update and document its internal procedures, as well as make privacy management guidelines accessible to all employees at AAFC. Privacy evaluation tools continue to be revised as program design changes are introduced in order to assess potential privacy risks associated with the deployment of new systems, activities and programs. These tools enable improved engagement with AAFC program officials during the design phase and prior to implementation, to ensure that all relevant details are captured early in the planning stages. The information collected during the evaluation process assists in determining whether a PIA or Protocol is warranted and ensures that sound advice and recommendations are shared to better enable “privacy-by-design” outcomes for new programs and activities.

7. Initiatives and projects to improve privacy

7.1 Innovation and client service

AAFC strives to be a leader in innovative and effective technology. Improving the client experience meant increasing value to the client's relationship with the Privacy Compliance Unit. While there are many ways to do this, the focus has been to foster a stronger connection with internal clients, by providing mutually beneficial solutions that reduce effort while meeting the department’s compliance requirements under the Privacy Act and supporting TBS Directives.

7.2 Generic Privacy Impact Assessment for grants and contributions programs at AAFC

Initiated in 2022-2023, the Privacy Compliance Unit completed an in-depth review of its library of privacy impact assessments for existing and planned grants and contributions programs at AAFC. Many were outdated, and newly designed programs were onboarding systems that required privacy risk assessments. To ensure that Treasury Board Secretariat (TBS) policies and directives were met, while streamlining the assessment process for PIAs at AAFC, the Privacy Compliance Unit developed the generic Grants and Contribution Programming (GGCP) PIA. This is an efficient mechanism to address standard privacy risks associated with these programs, as substantially similar collections, uses or disclosures of personal information occur in new Grants and Contribution programs.

When a program is deemed to fall under the generic PIA, a separate, unique PIA is not required, as privacy risks will be deemed “assessed and mitigated” pursuant to the generic PIA. To facilitate the screening process of qualifying new programs, the Privacy Compliance Unit revised its internal evaluation tool to incorporate an essential criterion required for any program being considered under the generic PIA. This innovative and effective approach has enabled efficient program launches, while ensuring that privacy risks are thoroughly evaluated and mitigated. While developed during the 2023-2024 fiscal year, submission to the Office of the Privacy Commissioner (OPC) and TBS was completed in May 2024. As such, this PIA will be accounted for in the 2024-2025 Privacy Annual Report to Parliament.

8. Summary of key issues and actions taken on complaints

There were no new complaints received in this reporting period. No court actions in relation to AAFC’s obligations under the Privacy Act were carried out during the reporting period. 

No requests were received from individuals seeking a correction or notation to their personal information pursuant to subsection 12(2) of the Privacy Act. 

9. Material privacy breaches

There were no material privacy breaches reported by AAFC during fiscal year 2023-2024. However, two large-scale incidents involving BGRS and SIRVA Canada systems, as well as a Canada Life data breach, occurred during this reporting period, which may have impacted AAFC employees. Investigations and coordinated responses were managed by TBS, on behalf of all affected federal departments. The Privacy Compliance Unit cooperated with TBS to ensure that all requested information was provided as requested and ensured that employees were made aware of the events either by internal communications or by direct external contact.

Thirteen (13) non-material privacy breaches were reported during the 2023-2024 fiscal year.

10. Privacy Impact Assessments

AAFC conducted one Privacy Impact Assessment during the 2023-2024 fiscal year and initiated three privacy protocols that will carry over into the 2024-2025 year.

10.1 Telematics Privacy Impact Assessment

The use of telematics began at Agriculture and Agri-Food Canada in 2019 when National Resources Canada (NRCAN) purchased telematics devices and issued them to various federal institutions, including AAFC; an initiative promoting activities to Green Government Operations.

Since installing the telematics devices, AAFC’s National Fleet Management Office (NFMO) began noticing driver behavior that was non-compliant with AAFC’s Departmental Policy on Motor Vehicles and local traffic laws. Consequently, and in collaboration with AAFC Labour Relations and AAFC Legal Services Unit (LSU), AAFC decided to institute a change to its practices – to use the telematics data to monitor employee compliance with its Departmental Policy on Motor Vehicles, which, in part, mandates staff to obey local traffic laws.

AAFC has a responsibility under Part II of the Canada Labour Code (Occupational Health and Safety) to ensure the health and safety (at work) of every person employed by the department. To ensure it is compliant with the health and safety requirements in Part II of the Canada Labour Code, AAFC conducted a PIA for this new administrative purpose.

11. Public interest disclosures

During 2022-2023, there were no disclosures made under section 8(2)(m) of the Privacy Act and, therefore, no section 8(5) written notifications made to the Office of the Privacy Commissioner.

12. Monitoring compliance

The Privacy Compliance Unit uses an automated case management system to track progress on all requests seeking guidance and advice related to the handling and use of personal information by the department.

Additionally, as this unit is responsible for monitoring the resolution of risks identified during a PIA, and for ensuring the implementation of strategies recommended to reduce them, a master Management Response Action Plan (MRAP) table is used to track and document recommendations for mitigating risks identified through completed privacy evaluations. As assessments are conducted, tables are prepared to document all risks identified, as well as areas of responsibility for resolution, and to review overdue actions to ensure completion in a timely manner.

For all other monitoring, the Privacy Compliance Unit is typically consulted any time it is indicated that personal information may be captured or handled. For example, AAFC has an automated questionnaire that employees fill out when requesting services for the development of a public opinion survey. If the client indicates the possible collection of personal information, the Privacy Compliance Unit is automatically notified and engaged. Additionally, the PCU is automatically engaged by AAFC Security when an AAFC client is requesting access to procure or use a new digital solution. The Privacy Compliance Unit receives a detailed report of the initiative, reviews it for privacy concerns and provides recommendations as required.

Standard requests for policy advice related to information Sharing Agreements and Treasury Board submissions are also routinely reviewed by the Privacy Compliance Unit and are typically approved at the program manager level and by the manager of the Privacy Compliance Unit. High profile, complex or contentious initiatives or privacy breaches are reviewed and approved by the Director of Access to Information and Privacy, who is the section 10 delegate at AAFC, and additional review and approvals are completed at the Director General or Assistant Deputy Minister level, as necessary.

13. Conclusion

Fiscal year 2023-2024 produced many engagement opportunities for AAFC’s ATIP Office and Privacy Compliance Unit and saw the final assessment and development of its generic privacy impact assessment for qualifying Grants and Contribution programs. Client engagement, improved collaboration and innovative, streamlined processes have been a key focus of both the ATIP Office and the Privacy Compliance Unit at AAFC. The ATIP Office has worked in partnership with senior officials and program officers to ensure compliance in all its other business streams.

AAFC continues to be committed to both the spirit and the intent of the Privacy Act to enhance the accountability and transparency of Government to promote an open and democratic society and to enable public debate on the conduct of all federal institutions. To this end, all privacy requests were responded to within established timelines.

Looking forward, the AAFC ATIP Office will continue to streamline processes, implement digital strategies, and support the department to meet the call to action from the Information Commissioner, the Office of the Privacy Commissioner, and the President of the Treasury Board to fulfill its commitment toward legislative requirements, openness, and the protection of personal information.

14. Annex A — Privacy Act designation order, Agriculture and Agri-Food Canada

The Minister of Agriculture and Agri-Food Canada, pursuant to section 73 of the Privacy Act, hereby designates the persons of the department holding the positions set out in the schedule hereto, or the persons occupying on an acting basis those positions, to exercise the powers and perform the duties and functions of the Minister as the head of a government institution under the sections of the Act set out in the schedule opposite each position. This Designation Order supersedes all previous Designation Orders.

Date:

Name: Minister of Agriculture and Agri-Food Canada

15. Annex B — Delegation of authority instrument for the administration of the Privacy Act

Sections of the Privacy Act	Powers, duties or functions	Assistant Deputy Minister, Public Affairs Branch	Director General, Communications Services	Director, ATIP and Translation Services	ATIP Manager
8(2)(j)	Disclosure of personal information for research of statistical purposes.	X	X	X	-
8(2)(m)	Disclosure of personal information in the public interest or in the interest of the individual.	X	X	X	-
8(4)	Copies of requests under paragraph 8(2)(e).	X	X	X	-
8(5)	Notice of disclosure under paragraph 8(2)(m).	X	X	X	-
9(1)	Record for disclosure.	X	X	X	-
9(4)	Consistent uses.	X	X	X	-
10	Personal information banks.	X	X	X	-
14	To notify applicant and to give access to the record.	X	X	X	X
15	To extend time limit and notify applicant.	X	X	X	X
16	Where access is refused	X	X	X	X
17(2)(b)	To determine the necessity for translation or interpretation of record.	X	X	X	X
17(3)(b)	Access to personal information in alternative format	X	X	X	X
18(2)	To refuse to disclose information contained in an exempt bank.	X	X	X	-
19(1)	To exempt personal information obtained in confidence from another government.	X	X	X	X
19(2)	To disclose with consent of the other government.	X	X	X	X
20	To exempt personal information re: federal-provincial affairs.	X	X	X	X
21	To exempt information re: international affairs and defense.	X	X	X	X
22	To exempt information re: law enforcement and investigation.	X	X	X	X
22.3	To exempt information re: Public Servants Disclosure Protection Act	X	X	X	X
23	To exempt information re: security clearances.	X	X	X	X
24	To exempt personal information re: individuals sentenced for an offense.	X	X	X	X
25	To exempt personal information re: safety of individuals.	X	X	X	X
26	To exempt personal information about another individual.	X	X	X	X
27	Protected information – solicitors and notaries.	X	X	X	X
28	To exempt personal information re: medical records.	X	X	X	X
33(2)	To make representations to the Privacy Commissioner during an investigation.	X	X	X	-
35(1)(b)	Notice of actions to implement recommendations of Commissioner.	X	X	X	-
35(4)	To provide access to applicant pursuant to Privacy Commissioner’s recommendation.	X	X	X	-
36(3)(b)	Notice of actions to implement recommendations of Commissioner concerning exempt banks.	X	X	X	-
37(3)	To receive report of Privacy Commissioner’s findings after compliance investigation.	X	X	X	-
51(2)(b), 51(3)	Special rules for hearings.	X	X	X	-
72	Annual Report to Parliament	X	X	X	-
73.1(4)	To charge fees for services.	X	X	X	-
73.1(3)	Notice of provision of services related to privacy.	X	X	X	-
73.1(5)	Spending authority	X	X	X	-
9	Examination of information.	X	X	X	X
11(2)	Notification that correction to personal information has been made	X	X	X	X
11(4)	Notification that correction to personal information has been refused	X	X	X	-
13(1)	Disclosure of personal information relating to physical or mental health may be disclosed to a duly qualified medical practitioner or psychologist in order to provide an opinion as to whether disclosure of the information would be contrary to the best interests of the individual	X	X	X	-
14	Disclosure of personal information relating to physical or mental health may be made to a requestor in the presence of a qualified medical practitioner or psychologist.	X	X	X	-

16. Annex C — Statistical report on the Privacy Act

Name of institution: Agriculture and Agri-Food Canada

Reporting period: 3/1/2023 to 3/31/2024

Section 1: Requests under the Privacy Act

1.1 Number of requests Received