2023-2024 Annual Report to Parliament on the Administration of the Privacy Act

Type of Publication: Annual Report
Date: October 2024
ISSN: 2817-9765

Table of contents

    Introduction

    The purpose of the Privacy Act is to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and that provide individuals with a right of access to that information.

    This annual report was prepared and submitted in accordance with section 72 of the Privacy Act and covers the period from April 1, 2023 to March 31, 2024.  OSFI does not have any non-operational subsidiaries.

    Mandate of the Office of the Superintendent of Financial Institutions (OSFI)

    OSFI’s mandate:

    Our purpose is to contribute to public confidence in the Canadian financial system by regulating and supervising approximately 400 federally regulated financial institutions (FRFIs) and 1200 federally regulated pension plans (FRPPs).

    Our mandate is to:

    • ensure FRFIs and FRPPs remain in sound financial condition
    • ensure FRFIs protect themselves against threats to their integrity and security, including foreign interference
    • act early when issues arise and require FRFIs and FRPPs to take necessary corrective measures without delay
    • monitor and evaluate risks and promote sound risk management by FRFIs and FRPPs

    In exercising our mandate:

    • for FRFIs, we strive to protect the rights and interests of depositors, policyholders and financial institution creditors while having due regard for the need to allow FRFIs to compete effectively and take reasonable risks
    • for FRPPs, we strive to protect the rights and interests of pension plan members, former members and entitled beneficiaries

    How we regulate and supervise financial institutions and pension plans

    We use our regulatory framework to balance the goals of safety and soundness. This allows federally regulated financial institutions to operate in a competitive marketplace. 

    We regulate by:

    • developing rules
    • interpreting legislation and regulations
    • providing regulatory approvals for certain types of transactions
    • contributing to new accounting, auditing and actuarial standards 

    We supervise institutions by:

    • analyzing financial and economic trends to detect issues 
    • assessing financial conditions, non-financial and material risks 
    • evaluating quality of governance, risk management and compliance

    Our role and benefits to Canada

    We play an important oversight role, but we don’t manage federally regulated financial institutions. Our goal is to balance both: 

    • competitiveness with financial stability
    • international standards with Canadian market realities 

    Our regulation and supervision activities contribute to public confidence in the Canadian financial system. 

    We’re funded through fees paid by regulated entities, not by Canadian taxpayers’ money.

    The Office of the Chief Actuary

    The Office of the Chief Actuary is an independent unit within OSFI that provides a range of actuarial valuation and advisory services to the Government of Canada. In conducting its work, the OCA plays a vital and independent role towards a financially sound and sustainable Canadian public retirement income system.

    Strategic Outcomes

    Primary to OSFI’s mandate and central to its contribution to Canada’s financial system are two strategic outcomes:

    • A safe and sound Canadian financial system
    • A financially sound and sustainable Canadian public retirement income system.

    For the purposes of the Privacy Act, the head of OSFI is the Superintendent and the responsible minister is the Minister of Finance.

    4. Administration of the Privacy Act

    4.1 Access to Information and Privacy (ATIP) Unit

    The Access to Information and Privacy (ATIP) Unit is part of the Central Office Directorate within the Corporate Services Sector. The unit is responsible for administering the Act for the Office of the Superintendent of Financial Institutions (OSFI). As such, the ATIP unit coordinates the timely processing of requests under the legislation, handles complaints lodged with the Office of the Privacy Commissioner, and responds to informal inquiries. The ATIP unit also provides advice and guidance to office staff on matters involving the Act.

    For the 2023-2024 fiscal year, the Manager, Privacy and Access to Information reported to the Director, Central Office, Corporate Services Sector and is supported by an ATIP Officer, a Junior ATIP Officer and an Administrative Assistant.  Both the ATIP Officer and the Junior ATIP Officer are considered regional staff. The ATIP unit also relied upon the support of contract resources.

    4.2 Institutional changes to the administration of the Privacy Act

    There were no significant institutional changes to the administration of the Act in 2023-2024. 

    4.3 Education and Training

    Training efforts in 2023-2024 have been focused on ensuring OSFI staff understand their roles and responsibilities in the effective management and protection of OSFI’s information resources as an enabler in the delivery of the ATI program through a combination of presentations, information sessions and information bulletins. Training efforts focused on ATIP refresher courses for the sectors ATIP Liaison Officers and Central Office Teams (2 sessions, 11 participants).

    4.4 Processing of Privacy requests

    All formal privacy requests are submitted to the Manager, Privacy and Access to Information, who reviews and assigns them to an ATIP Officer. The Officer requests the information from the appointed sectoral ATIP Liaison Officer(s) concerned. In gathering the material and subsequently reviewing it, the ATIP Office provides advice and direction to ensure that the provisions of the Act are respected.

    Assembled material is reviewed by the ATIP Officer and the Manager, Privacy and Access to Information. The material and the recommendations pertaining to each request are then submitted to the program area for validation. Once agreed, the release package is submitted to the Director, Central Office, Corporate Services for review and approval.

    Employees have the right to review their personal records at intervals specified in the various collective agreements. To exercise this right, an employee contacts the appropriate official in the Human Resources division. The review of personal records is considered informal and no data on these requests is compiled. The employee, however, does have the option of submitting a formal request under the privacy legislation. Employees of the Human Resources Division are aware of the provisions of the Privacy Act as they relate to the use and disclosure of personal information.

    4.5 Delegation of authority

    Administration of the Privacy Act at OSFI is ultimately the responsibility of the Superintendent; However, delegation orders set out which powers, duties and functions relating to the administration of the Privacy Act, have been delegated by the head of the institution, and to whom,  effective January 23rd, 2024, all powers, duties, or functions are delegated to the Assistant Superintendent, Corporate Services & Chief Operating Officer.  The Chief of Staff, Corporate Services, the Chief Financial Officer, the Director, Central Office Corporate Services, the Manager, Access to Information & Privacy and the Manager, Privacy are also granted specific powers under the Act.  See the attached order in Appendix B.

    4.6 Monitoring compliance

    The time taken to process requests made under the Privacy Act is tracked in the ATIP tracking system. Proposed final responses to privacy requests are ultimately reviewed and approved by the Director, Central Office. Concerns are raised as appropriate throughout the lifecycle of the request and priority is given to fulfilling OSFI’s statutory obligations.

    4.7 Summary of significant changes to programs, operations, policies, or procedures

    Requests received by OSFI through the mail are retrieved by the Manager, Access to Information and Privacy as needed. Of note, for the duration of the 2023-2024 fiscal year, the ATIP team reported to the Office of the Chief Financial Officer, Corporate Services Sector.  The Privacy Office has modernized privacy management by creating standardized templates for Privacy assessments. They have also begun the implementation of an automated system using Microsoft Power Automate to streamline privacy intake requests and determine necessary actions for processing. Additionally, the team continures to develop and offer department-wide training to ensure comprehensive understanding and application of privacy practices at OSFI.  OSFI now utilizes the Government of Canada’s ATIP Online Request Service (AORS) to receive, process and respond to request made under the Privacy Act.  OSFI is also in the process of modernizing its existing ATIP case management software.  For the reporting period, OSFI was not subject to any service agreements under section 73.1 of the Privacy Act.

    4.8 Reading room

    In accordance with the Access to Information Act, a public reading room is available in Ottawa. It is located at 255 Albert Street, on the 16th floor.

    5. Interpretation of the Statistical Report

    Part 1 – Requests under the Privacy Act

    Due to the nature of OSFI’s work regulating and supervising financial institutions and private pension plans under federal jurisdiction, much of the information in the Office’s possession is third-party business information rather than personal information about individuals. The financial institutions and pension plans are OSFI’s clients. As OSFI does not provide services directly to individuals, the volume of personal information collected by the Office is relatively small. This information is generally limited to employment records of current and previous OSFI employees and information about individual contract consultants at OSFI.

    In 2023-2024, 10 new requests were received. Since the inception of the Privacy Act, July 1, 1983, OSFI has received 94 privacy requests.

    Part 2 – Requests closed during the reporting period

    The following table summarizes the actions taken with respect to the completed requests:

    2.1 Disposition and Completion Time

    Disposition Number of requests
    All disclosed 0
    Disclosed in part 9
    All exempted 0
    All excluded 0
    No records exist 0
    Request abandoned 1
    Neither confirmed nor denied 0
    Total 10

    For the 10 requests received in 2023-2024:

    • 100% were closed within legislated timelines;
    • There were no requests carried over from the previous reporting period and none were any carried over to the next reporting period;
    • 1 was completed in 1 to 15 days; and,
    • 2 were completed in 16 to 30 days; and,
    • 6 were closed in 31 to 60 days; and,
    • 1 was completed in 61 to 120 days.

    2.2 Exemptions

    Section 22(1)(b) was applied to 1 privacy request.  Section 26 was applied to 9 requests. Section 27 was applied to 1 request.

    2.3 Exclusions

    No exclusions were cited during the reporting period.

    2.4 Format of Information Released

    During the reporting period, 7 requests under the Privacy Act were released electronically and 2 were released in paper format.

    2.5 Relevant Pages Processed and Disclosed

    18,638 relevant pages were processed, and 5,875 pages were disclosed during the reporting period. 90% of the requests received during the reporting period were disclosed in part and OSFI was unable to process the remaining request as the request was abandoned.

    2.6 Other complexities

    There were no other complexities required during the reporting period.

    2.7 Deemed Refusal

    There were no deemed refusals for the reporting period.

    2.8 Requests for Translation

    No translations were requested in 2023-2024.

    Part 3 – Disclosures under Subsections 8(2) and 8(5)

    No disclosures were made pursuant to subsections 8(2)(e), 8(2)(m) or 8(5) of the Privacy Act during this reporting period.

    Part 4 – Requests for correction of personal information and notations

    No requests for correction of personal information and no notations were made during this reporting period.

    Part 5 - Extensions

    Additional 30-day extensions were required for 7 requesst during this reporting period:

    • 7 pursuant to s.15(a)(i) – Interference with operations (further review required to determine exemptions, large volume of pages).

    Part 6 - Consultations received from other government Institutions

    No consultations from other government institutions and organizations were received during the reporting period.

    Part 7 – Completion Time of Consultations on Cabinet Confidences

    No consultations with respect to Cabinet confidences were required during the reporting period.

    Part 8 – Resources Related to the Privacy Act

    The cost to administer the Act during this reporting period was $310,754.

    6. Complaints and Investigations

    OSFI did not receive any complaints pursuant to the Privacy Act during this reporting period. There were no active complaints from previous reporting periods.

    7. Privacy Breaches

    There were no material privacy breaches reported during the 2023-2024 fiscal year.

    8. Appeals to the Federal Court of Canada

    8.1 – Major changes implemented as a result of concerns or issues raised by the Privacy Commissioner of Canada in his annual report to Parliament

    The Privacy Commissioner of Canada did not raise any concerns or issues related to OSFI, therefore no major changes were implemented.

    8.2 – Major changes implemented as a result of concerns or issues raised by other agents of Parliament

    No major changes were implemented by OSFI as other agents of Parliament did not raise any concerns or issues.

    8.3 – Number of applications or appeals to the Federal Court of the Federal Court of Appeal during the fiscal year

    There were no access to information related applications or appeals to the Federal Court or the Federal Court of Appeal during this fiscal year related to OSFI.

    9. Completed Privacy Impact Assessments

    OSFI completed 2 Privacy Impact Assessments in 2023-2024 for Software for Staffing (VidCruiter) and the Transformation Office Data Analytics Initiative.

    VidCruiter is a Canadian company that offers video interviewing software with live and pre-recorded options. OSFI has procured access to VidCruiter to increase efficiencies in recruitment and staffing through the Applicant Tracking System (ATS), virtual assessments and interviews. 

    The Transformation Office (TO) (a new enterprise function established in April of 2022) is responsible for OSFI’s Blueprint Transformation initiatives and ensuring they are fully integrated on both operational and strategic levels. To do this, TO requires access to and sharing of data sources from across different functional units across OSFI. The objective of gaining access to these data sets is to enable data analytics to inform decision-making and monitor progress and the pace of transformational change. 

    The summaries for the two completed PIA’s have not been published as of August 2024.

    10. Authority for new collection of Social Insurance Numbers

    OSFI did not receive authority or undertake any new collections or consistent use of Social Insurance Numbers during the reporting period.

    Appendix A – Statistical Report on the Privacy Act

    Statistical Report on the Privacy Act

    Name of institution: Office of the Superintendent of Financial Institutions

    Reporting period: 4/1/2022 to 3/31/2023

    Section 1: Requests Under the Privacy Act

    1.1 Number of requests received

      Number of Requests
    Received during reporting period 10
    Outstanding from previous reporting periods 0
    Outstanding from previous reporting period 0
    Outstanding from more than one reporting period 0
    Total 10
    Closed during reporting period 10
    Carried over to next reporting period 0
    Carried over within legislated timeline 0
    Carried over beyond legislated timeline 0

    1.2 Channels of requests

    Source Number of Requests
    Online 5
    E-mail 4
    Mail 1
    In person 0
    Phone 0
    Fax 0
    Total 10

    Section 2: Informal requests

    2.1 Number of informal requests

      Number of Requests
    Received during reporting period 0
    Outstanding from previous reporting periods 0
    Outstanding from previous reporting period 0
    Outstanding from more than one reporting period 0
    Total 0
    Closed during reporting period 0
    Carried over to next reporting period 0

    2.2 Channels of informal requests

    Source Number of Requests
    Online 0
    E-mail 0
    Mail 0
    In person 0
    Phone 0
    Fax 0
    Total 0

    2.3 Completion time of informal requests

    Completion Time
    1 to 15 Days 16 to 30 Days 31 to 60 Days 61 to 120 Days 121 to 180 Days 181 to 365 Days More Than 365 Days Total
    0 0 0 0 0 0 0 0

    2.4 Pages released informally

    Less Than 100 Pages Released 100-500 Pages Released 501-1000 Pages Released 1001-5000 Pages Released More Than 5000 Pages Released
    Number of Requests Pages Released Number of Requests Pages Released Number of Requests Pages Released Number of Requests Pages Released Number of Requests Pages Released
    0 0 0 0 0 0 0 0 0 0

    Section 3: Requests Closed During the Reporting Period

    3.1 Disposition and completion time

    Disposition of Requests Completion Time
    1 to 15 Days 16 to 30 Days 31 to 60 Days 61 to 120 Days 121 to 180 Days 181 to 365 Days More Than 365 Days Total
    All disclosed 0 0 0 0 0 0 0 0
    Disclosed in part 0 2 6 1 0 0 0 9
    All exempted 0 0 0 0 0 0 0 0
    All excluded 0 0 0 0 0 0 0 0
    No records exist 0 0 0 0 0 0 0 0
    Request abandoned 1 0 0 0 0 0 0 0
    Neither confirmed nor denied 0 0 0 0 0 0 0 0
    Total 1 2 6 1 0 0 0 10

    3.2 Exemptions

    Section Number of Requests
    18(2) 0
    19(1)(a) 0
    19(1)(b) 0
    19(1)(c) 0
    19(1)(d) 0
    19(1)(e) 0
    19(1)(f) 0
    20 0
    21 0
    22(1)(a)(i) 0
    22(1)(a)(ii) 0
    22(1)(a)(iii) 0
    22(1)(b) 1
    22(1)(c) 0
    22(2) 0
    22.1 0
    22.2 0
    22.3 0
    22.4 0
    23(a) 0
    23(b) 0
    24(a) 0
    24(b) 0
    25 0
    26 9
    27 1
    27.1 0
    28 0

    3.3 Exclusions

    Section Number of Requests
    69(1)(a) 0
    69(1)(b) 0
    69.1 0
    70(1) 0
    70(1)(a) 0
    70(1)(b) 0
    70(1)(c) 0
    70(1)(d) 0
    70(1)(e) 0
    70(1)(f) 0
    70.1 0

    3.4 Format of information released

    Paper Electronic Other
    E-record Data set Video Audio
    2 7 0 0 0 0

    3.5 Complexity

    3.5.1 Relevant pages processed and disclosed for *paper* and *e-record* formats
    Number of Pages Processed Number of Pages Disclosed Number of Requests
    18638 5875 10
    3.5.2 Relevant pages processed by request disposition for *paper* and *e-record* formats by size of requests
    Disposition Less Than 100 Pages Processed 100-500 Pages Processed 501-1000 Pages Processed 1001-5000 Pages Processed More Than 5000 Pages Processed
    Number of Requests Pages Processed Number of Requests Pages Processed Number of Requests Pages Processed Number of Requests Pages Processed Number of Requests Pages Processed
    All disclosed 0 0 0 0 0 0 0 0 0 0
    Disclosed in part 1 63 2 527 2 1797 3 5158 1 11093
    All exempted 0 0 0 0 0 0 0 0 0 0
    All excluded 0 0 0 0 0 0 0 0 0 0
    Request abandoned 1 0 0 0 0 0 0 0 0 0
    Neither confirmed nor denied 0 0 0 0 0 0 0 0 0 0
    Total 2 63 2 527 2 1797 3 5158 1 11093
    3.5.3 Relevant minutes processed and disclosed for *audio* formats
    Number of Minutes Processed Number of Minutes Disclosed Number of Requests
    0 0 0
    3.5.4 Relevant minutes processed per request disposition for *audio* formats by size of requests
    Disposition Less than 60 Minutes processed 60 - 120 Minutes processed More than 120 Minutes processed
    Number of requests Minutes Processed Number of requests Minutes Processed Number of requests Minutes Processed
    All disclosed 0 0 0 0 0 0
    Disclosed in part 0 0 0 0 0 0
    All exempted 0 0 0 0 0 0
    All excluded 0 0 0 0 0 0
    Request abandoned 0 0 0 0 0 0
    Neither confirmed nor denied 0 0 0 0 0 0
    Total 0 0 0 0 0 0
    3.5.5 Relevant minutes processed and disclosed for *video* formats
    Number of Minutes Processed Number of Minutes Disclosed Number of Requests
    0 0 0
    3.5.6 Relevant minutes processed per request disposition for *video* formats by size of requests
    Disposition Less than 60 Minutes processed 60 - 120 Minutes processed More than 120 Minutes processed
    Number of requests Minutes Processed Number of requests Minutes Processed Number of requests Minutes Processed
    All disclosed 0 0 0 0 0 0
    Disclosed in part 0 0 0 0 0 0
    All exempted 0 0 0 0 0 0
    All excluded 0 0 0 0 0 0
    Request abandoned 0 0 0 0 0 0
    Neither confirmed nor denied 0 0 0 0 0 0
    Total 0 0 0 0 0 0
    3.5.7 Other complexities
    Disposition Consultation Required Legal Advice Sought Interwoven Information Other Total
    All disclosed 0 0 0 0 0
    Disclosed in part 0 0 0 0 0
    All exempted 0 0 0 0 0
    All excluded 0 0 0 0 0
    Request abandoned 0 0 0 0 0
    Neither confirmed nor denied 0 0 0 0 0
    Total 0 0 0 0 0

    3.6 Closed requests

    3.6.1 Number of requests closed within legislated timelines
    Number of requests closed within legislated timelines 10
    Percentage of requests closed within legislated timelines (%) 100

    3.7 Deemed refusals

    3.7.1 Reasons for not meeting legislated timelines
    Number of requests closed past the legislated timelines Principal Reason
    Interference with operations/ Workload External Consultation Internal Consultation Other
    0 0 0 0 0
    3.7.2 Request closed beyond legislated timelines (including any extension taken)
    Number of days past legislated timelines Number of requests past legislated timeline where no extension was taken Number of requests past legislated timeline where an extension was taken Total
    1 to 15 days 0 0 0
    16 to 30 days 0 0 0
    31 to 60 days 0 0 0
    61 to 120 days 0 0 0
    121 to 180 days 0 0 0
    181 to 365 days 0 0 0
    More than 365 days 0 0 0
    Total 0 0 0

    3.8 Requests for translation

    Translation Requests Accepted Refused Total
    English to French 0 0 0
    French to English 0 0 0
    Total 0 0 0

    Section 4: Disclosures Under Subsections 8(2) and 8(5)

    Paragraph 8(2)(e) Paragraph 8(2)(m) Subsection 8(5) Total
    0 0 0 0

    Section 5: Requests for Correction of Personal Information and Notations

    Disposition for Correction Requests Received Number
    Notations attached 0
    Requests for correction accepted 0
    Total 0

    Section 6: Extensions

    6.1 Reasons for extensions

    Number of requests where an extension was taken 15(a)(i) Interference with operations 15 (a)(ii) Consultation 15(b) Translation purposes or conversion
    Further review required to determine exemptions Large volume of pages Large volume of requests Documents are difficult to obtain Cabinet Confidence Section (Section 70) External Internal
    7 2 5 0 0 0 0 0 0

    6.2 Length of extensions

    Length of Extensions 15(a)(i) Interference with operations 15 (a)(ii) Consultation 15(b) Translation purposes or conversion
    Further review required to determine exemptions Large volume of pages Large volume of requests Documents are difficult to obtain Cabinet Confidence Section (Section 70) External Internal
    1 to 15 days 0 0 0 0 0 0 0 0
    16 to 30 days 2 5 0 0 0 0 0 0
    31 days or greater 0 0 0 0 0 0 0 0
    Total 2 5 0 0 0 0 0 0

    Section 7: Consultations Received From Other Institutions and Organizations

    7.1 Consultations received from other Government of Canada institutions and other organizations

    Consultations Other Government of Canada Institutions Number of Pages to Review Other Organizations Number of Pages to Review
    Received during the reporting period 0 0 0 0
    Outstanding from the previous reporting period 0 0 0 0
    Total 0 0 0 0
    Closed during the reporting period 0 0 0 0
    Carried over within negotiated timelines 0 0 0 0
    Carried over beyond negotiated timelines 0 0 0 0

    7.2 Recommendations and completion time for consultations received from other Government of Canada institutions

    Recommendation Number of Days Required to Complete Consultation Requests
    1 to 15 Days 16 to 30 Days 31 to 60 Days 61 to 120 Days 121 to 180 Days 181 to 365 Days More Than 365 Days Total
    Disclose entirely 0 0 0 0 0 0 0 0
    Disclose in part 0 0 0 0 0 0 0 0
    Exempt entirely 0 0 0 0 0 0 0 0
    Exclude entirely 0 0 0 0 0 0 0 0
    Consult other institution 0 0 0 0 0 0 0 0
    Other 0 0 0 0 0 0 0 0
    Total 0 0 0 0 0 0 0 0

    7.3 Recommendations and completion time for consultations received from other organizations outside the Government of Canada

    Recommendation Number of Days Required to Complete Consultation Requests
    1 to 15 Days 16 to 30 Days 31 to 60 Days 61 to 120 Days 121 to 180 Days 181 to 365 Days More Than 365 Days Total
    Disclose entirely 0 0 0 0 0 0 0 0
    Disclose in part 0 0 0 0 0 0 0 0
    Exempt entirely 0 0 0 0 0 0 0 0
    Exclude entirely 0 0 0 0 0 0 0 0
    Consult other institution 0 0 0 0 0 0 0 0
    Other 0 0 0 0 0 0 0 0
    Total 0 0 0 0 0 0 0 0

    Section 8: Completion Time of Consultations on Cabinet Confidences

    8.1 Requests with Legal Services

    Number of Days Fewer Than 100 Pages Processed 100-500 Pages Processed 501-1000 Pages Processed 1001-5000 Pages Processed More Than 5000 Pages Processed
    Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed
    1 to 15 0 0 0 0 0 0 0 0 0 0
    16 to 30 0 0 0 0 0 0 0 0 0 0
    31 to 60 0 0 0 0 0 0 0 0 0 0
    61 to 120 0 0 0 0 0 0 0 0 0 0
    121 to 180 0 0 0 0 0 0 0 0 0 0
    181 to 365 0 0 0 0 0 0 0 0 0 0
    More than 365 0 0 0 0 0 0 0 0 0 0
    Total 0 0 0 0 0 0 0 0 0 0

    8.2 Requests with Privy Council Office

    Number of Days Fewer Than 100 Pages Processed 100-500 Pages Processed 501-1000 Pages Processed 1001-5000 Pages Processed More Than 5000 Pages Processed
    Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed Number of Requests Pages Disclosed
    1 to 15 0 0 0 0 0 0 0 0 0 0
    16 to 30 0 0 0 0 0 0 0 0 0 0
    31 to 60 0 0 0 0 0 0 0 0 0 0
    61 to 120 0 0 0 0 0 0 0 0 0 0
    121 to 180 0 0 0 0 0 0 0 0 0 0
    181 to 365 0 0 0 0 0 0 0 0 0 0
    More than 365 0 0 0 0 0 0 0 0 0 0
    Total 0 0 0 0 0 0 0 0 0 0

    Section 9: Complaints and Investigations Notices Received

    Section 31 Section 33 Section 35 Court action Total
    0 0 0 0 0

    Section 10: Privacy Impact Assessments (PIAs) and Personal Information Banks (PIBs)

    10.1 Privacy Impact Assessments

    Number of PIAs completed 2
    Number of PIAs modified 0

    10.2 Institution-specific and Central Personal Information Banks

    Personal Information Banks Active Created Terminated Modified
    Institution-specific 2 0 0 0
    Central 55 0 0 0
    Total 57 0 0 0

    Section 11: Privacy Breaches

    11.1 Material Privacy Breaches reported

    Number of material privacy breaches reported to TBS 0
    Number of material privacy breaches reported to OPC 0

    11.2 Non-Material Privacy Breaches

    Number of non-material privacy breaches: 3

    Section 12: Resources Related to the Privacy Act

    12.1 Allocated Costs

    Expenditures Amount
    Salaries $293,490
    Overtime $0
    Goods and Services $17,264
    Professional services contracts $17,264
    Other $0
    Total $310,754

    12.2 Human Resources

    Resources Person Years Dedicated to Privacy Activities
    Full-time employees 2.480
    Part-time and casual employees 0.000
    Regional staff 0.100
    Consultants and agency personnel 0.060
    Students 0.000
    Total 2.640
    Note: Enter values to three decimal places.

    Supplemental Statistical Report on the Access to Information Act and the Privacy Act

    Name of institution: Office of the Superintendent of Financial Institutions

    Reporting period: 2023-04-01 to 2024-03-31

    Section 1: Open Requests and Complaints Under the Access to Information Act

    1.1 Enter the number of open requests that are outstanding from previous reporting periods

    Fiscal Year Open Requests Were Received Open Requests that are Within Legislated Timelines as of
    March 31, 2024    		 Open Requests that are Beyond Legislated Timelines as of
    March 31, 2024    		  Total
    Received in 2023-24 8 0 8
    Received in 2022-23 0 0 0
    Received in 2021-22 0 0 0
    Received in 2020-21 0 0 0
    Received in 2019-20 0 0 0
    Received in 2018-19 0 0 0
    Received in 2017-18 0 0 0
    Received in 2016-17 0 0 0
    Received in 2015-16 0 0 0
    Received in 2014-15 or earlier 0 0 0
    Total 8 0 8
    Fiscal Year Open Complaints Were Received by Institution  Number of Open Complaints
    Received in 2023-24 2
    Received in 2022-23 1
    Received in 2021-22 1
    Received in 2020-21 0
    Received in 2019-20 0
    Received in 2018-19 0
    Received in 2017-18 0
    Received in 2016-17 0
    Received in 2015-16 0
    Received in 2014-15 or earlier 0
    Total 4

    1.2 Enter the number of open complaints with the Information Commissioner of Canada that are outstanding from previous reporting periods.

    Fiscal Year Open Complaints Were Received by Institution Number of Open Complaints
    Received in 2023-24 2
    Received in 2022-23 1
    Received in 2021-22 1
    Received in 2020-21 0
    Received in 2019-20 0
    Received in 2018-19 0
    Received in 2017-18 0
    Received in 2016-17 0
    Received in 2015-16 0
    Received in 2014-15 or earlier 0
    Total 4

    Section 2: Open Requests and Complaints Under the Privacy Act

    2.1 Enter the number of open requests that are outstanding from previous reporting periods.

    Fiscal Year Open Requests Were Received Open Requests that are Within Legislated Timelines as of
    March 31, 2024    		 Open Requests that are Beyond Legislated Timelines as of
    March 31, 2024    		  Total
    Received in 2023-24 0 0 0
    Received in 2022-23 0 0 0
    Received in 2020-21 0 0 0
    Received in 2019-20 0 0 0
    Received in 2018-19 0 0 0
    Received in 2017-18 0 0 0
    Received in 2016-17 0 0 0
    Received in 2015-16 0 0 0
    Received in 2014-15 or earlier 0 0 0
    Total 0 0 0

    2.2 Enter the number of open complaints with the Privacy Commissioner of Canada that are outstanding from previous reporting periods.

    Fiscal Year Open Complaints Were Received by Institution Number of Open Complaints
    Received in 2023-24 0
    Received in 2022-23 0
    Received in 2021-22 0
    Received in 2020-21 0
    Received in 2019-20 0
    Received in 2018-19 0
    Received in 2017-18 0
    Received in 2016-17 0
    Received in 2015-16 0
    Received in 2014-15 or earlier 0
    Total 0

     Section 3: Social Insurance Number   

    Has your institution begun a new collection or a new consistent use of the SIN in 2023-24? : no

     Section 4: Universal Access under the Privacy Act

    How many requests were received from foreign nationals outside of Canada in 2023-24? : 0

    Appendix B – Designation Order: Privacy Act

    Designation / Délégation

    Access to Information Act / Loi sur l’accès à l’information

    Designation Order for the Access to Information Act and the Privacy Act

    By this order made pursuant to sections 95(1) of the Access to Information Act and 73(1) of the Privacy Act, I hereby authorize those officers and employees of the Office of the Superintendent of Financial Institutions occupying, on an acting basis or otherwise, the positions identified within the attached schedule to perform on my behalf any of the powers, duties or functions specified therein.

    This designation replaces and repeals all previous orders.

    Dated in Ottawa on this 23rd day of January, 2024

    Arrêté sur la délégation en vertu de la Loi sur l’accès à l’information et la Loi sur la protection des renseignments personnels

    Par le présent arrêté pris en vertu des l’articles 95(1) de la Loi sur l’accès à l’information et 73(1) de la Loi sur la protection des renseignments personnels, j’autorise les agents et les employés du Bureau du surintendant des institutions financières occupant, par intérim ou autrement, les postes identifiés dans l’annexe ci-jointe à exercer en mon nom, les attributions, les fonctions et les pouvoirs qui y sont spécifiés.

    Le présent document remplace et annule tous les arrêtés antérieurs.

    Fait à Ottawa en ce 23ième jour de janvier 2024

    Peter Routledge
    Superintendent of Financial Institutions/
    Le surintendant des institutions financères

    Schedules

    Position / Poste Access to information Act and Regulations / Loi sur l’accès à l’information et règlements Privacy Act and Regulations / Loi sur la protection des renseignements personnels et règlements
    Assistant Superintendent, Chief Operating Officer Full authority / Autorité absolue Full authority / Autorité absolue
    Chief of Staff, Assistant Superintendent, Chief Operating Officer Full authority / Autorité absolue

    Act: 8(4), 8(5), 9(1), 9(4), 10, 14(a), 14(b), 15, 17(2)(b), 17(3)(b), 18(2), 19(1), 19(2), 20, 21, 22, 22.3, 23, 24, 25, 26, 27, 28, 33(2), 35(4), 51(2)(b), 72(1)

    Regulations: 7, 9, 11(2), 11(4), 13(1), 14
    Chief Financial Officer Full authority / Autorité absolue

    Act: 8(4), 8(5), 9(1), 9(4), 10, 14(a), 14(b), 15, 17(2)(b), 17(3)(b), 18(2), 19(1), 19(2), 20, 21, 22, 22.3, 23, 24, 25, 26, 27, 28, 33(2), 35(4), 51(2)(b), 72(1)

    Regulations: 7, 9, 11(2), 11(4), 13(1), 14
    Director, Central Office Full authority / Autorité absolue

    Act: 8(4), 8(5), 9(1), 9(4), 10, 14(a), 14(b), 15, 17(2)(b), 17(3)(b), 18(2), 19(1), 19(2), 20, 21, 22, 22.3, 23, 24, 25, 26, 27, 28, 33(2), 35(4), 51(2)(b), 72(1)

    Regulations: 7, 9, 11(2), 11(4), 13(1), 14
    Manager, Access to Information and Privacy Full authority / Autorité absolue

    Act: 8(4), 8(5), 9(1), 9(4), 10, 14(a), 14(b), 15, 17(2)(b), 17(3)(b), 18(2), 19(1), 19(2), 20, 21, 22, 22.3, 23, 24, 25, 26, 27, 28, 33(2), 35(4), 51(2)(b), 72(1)

    Regulations: 7, 9, 11(2), 11(4), 13(1), 14
    Manager, Privacy Full authority / Autorité absolue

    Act: 8(4), 8(5), 9(1), 9(4), 10, 14(a), 14(b), 15, 17(2)(b), 17(3)(b), 18(2), 19(1), 19(2), 20, 21, 22, 22.3, 23, 24, 25, 26, 27, 28, 33(2), 35(4), 51(2)(b), 72(1)

    Regulations: 7, 9, 11(2), 11(4), 13(1), 14
    Date modified: