Information Access and Privacy Services. Annual Report

Transcription

1 Information Access and Privacy Services Annual Report

2 Crown copyright, Province of Nova Scotia, 2016

3 Contents A Year in Transition... 1 Consolidation of Access and Privacy Services in Nova Scotia... 1 Our Mandate... 1 Legislation Highlights... 2 Consolidation Successes... 2 New Reporting Timeframes... 2 Strengthening Our Access and Privacy Programs... 3 AccessPro Case Management System... 3 New Redaction Software... 3 Looking Forward... 4 Information Access and Privacy Framework... 4 Training, Education, and Awareness Program... 4 Disclosure Log Increasing Accountability... 4 Make a FOIPOP Request Online The Year in Numbers... 5 Understanding the Data... 5 How Applications are Received and Processed... 6 Denied Applications... 8 Exemptions... 8 Other Statutes Prevail... 8 Other Decisions... 9 Exclusions... 9 Non-Exclusions... 9

4 FOIPOP Government Departments FOIPOP Applications Received Per Government Department FOIPOP Applications Completed Per Government Department FOIPOP Other Public Bodies FOIPOP Applications Received Per Other Public Body FOIPOP Applications Completed Per Other Public Body Municipal Government Act (MGA) Applications Received Per Municipal Entity Applications Completed Per Municipal Entity Routine Access Requests FOIPOP and MGA Fees... 20

5 Letter from the Minister I am pleased to submit the Annual Report of Information Access and Privacy (IAP) Services. This report provides an overview of the government departments and other public sector activities related to the Freedom of Information and Protection of Privacy (FOIPOP) Act. IAP Services is a division of Information, Communications and Technology Services (ICTS) within the Department of Internal Services (ISD). In 2015, IAP Services began its consolidation of the access and privacy function across government. The formation of centralized IAP Services supports consistent approaches, practices and systems and enables more efficient and effective access to information. The transition resulted in a strong team of professionals working daily for 27 client departments and selected agencies to deliver excellent access to information and privacy services. In the following pages, you will learn more about the IAP work during this transition year. I would like to thank the many IAP Administrators for their dedication and effort. When consolidation is complete, IAP will provide a higher standard of service to all those seeking access to government information and protection of their privacy. The Honourable Labi Kousoulis Minister of Internal Services

6

7 A Year in Transition Consolidation of Access and Privacy Services in Nova Scotia In 2014, Information Access and Privacy (IAP) Services prepared to consolidate access and privacy services and developed a transition plan to do so. In 2015, IAP Services began to roll out that plan, bringing staff from their home departments to the new central IAP Services division within the Department of Internal Services. IAP has offered support to client departments since July 2015; however the transfer of staff, budgets, and other resources continued throughout , when IAP Services switched to fiscal-year reporting from calendar year to align with the government standard. Despite being in a transitional period, positive results of the consolidation are beginning to appear. The rate at which departments responded to FOIPOP requests within the legislated 30 days increased from 78 per cent in 2014 to 81 per cent in 2015, and to 84 per cent in fiscal year IAP Services entered into agreements with client departments during , and implemented a new case management system to support the processing of the FOIPOP requests. Development of common guidelines and processes to guide the work began in including the development of an Information Access and Privacy Program Framework and project plan that will generate a number of projects for the upcoming fiscal year, including a new awareness program for all government employees, which will be delivered beginning in early By the time these efforts were accomplished in April of 2016, IAP Services had achieved stabilization of resources, reached the end of phase one of consolidation, and entered the transformation phase. Next year s report will give an account of the activities that will take place in that next phase. The report is expected to show that the new operating model has improved the Province s objective to ensure that Nova Scotians consistently receive quality access to information services as well as robust protection of their personal information that is in the custody of the Province. Our Mandate The mandate of IAP Services is to: strengthen government s access and privacy programs increase level of expertise and influence a more strategic thinking implement innovative approaches to disclosure, aligned with open information thinking increase awareness and understanding of information access and privacy principle balance the right of citizens to obtain government information with government s obligation to protect citizen privacy Information Access and Privacy Services Annual Report

8 We achieve this balance within the context of our current statutes: the Freedom of Information and Protection of Privacy (FOIPOP) Act, the Personal Information International Disclosure Protection Act (PIIDPA), Privacy Review Officer (PRO) Act and relevant regulations and policies. Legislation The FOIPOP Act applies to provincial government departments, agencies, boards, and commissions, community colleges, the NS Health Authority, the IWK, universities, and school boards. Municipalities and municipal police forces are also defined as public bodies and, therefore, are subject to similar access and privacy provisions. Their decisions about the information they hold are governed by Part XX of the Municipal Government Act (MGA), which mirrors the FOIPOP Act Highlights Consolidation Successes IAP Services was created to bring all access and privacy resources into one unit, to standardize corporate best practices and build stronger access and privacy programs. Consolidation is already allowing for continuous cross-training, sharing of expertise, and better use of limited resources. In , this work will continue with the development of training materials to support employees and contractors and to guide the work of the IAP Administrators. The new combined structure allowed IAP Services to effectively organize itself to respond to a massive FOIPOP application campaign launched by a public-interest group in the fall and winter of More than 300 applications from that one group arrived for processing in a 3-month time period. With the new operating model, IAP Services was able to effectively maximize the available resources and respond accurately to those requests, and in most cases within the 30-day legislated time. If government had faced a similar campaign while IAP Administrators were still located in individual departments, the outcome may not have been as successful. In fact, it was during this period that the 30-day response rate went up to 84 per cent and the unit continued to balance the requests received by other individuals and organizations despite the overwhelming volume of applications. New Reporting Timeframes This year is the first year where we have aligned to the fiscal year (April 1, 2015 to March 31, 2016) for reporting. The change has been made to align with standard government reporting timelines, as well as the reporting framework of the Office of the Information and Privacy Commissioner for Nova Scotia. To assist with the transition we are also reporting on the calendar year Information Access and Privacy Services Annual Report

9 Strengthening Our Access and Privacy Programs IAP Services developed an Information Access and Privacy Framework in to identify gaps that need to be filled to improve information access and privacy practices. The framework establishes the pillars of the information access and privacy programs: governance and accountability, program controls and processes, monitoring and oversight, and opportunities for alignment with other areas within Information Communications and Technical Services. This framework will guide all of our work over the coming year. Information Access and Privacy Framework Operational Model Governance and Accountability Program controls and processes Alignment with other ICT services Monitoring and oversight Executive and organizational commitment Legislation Roles and responsibilities Reporting mechanisms Policies and procedures Training, education, and awareness Information access Procedures manual AccessPro Case Management System Proactive disclosure Privacy PIAs Breach management Compliant process Agreements Collaboration model Service provider management Program evaluation Monitoring compliance Collaboration with oversight body Continuous improvement AccessPro Case Management System Throughout the year, IAP Services prepared for the launch, on April 1, 2016, of our new digital case management system, AccessPro. The system replaces a very outdated tracking system. AccessPro, which belongs to the Amanda family of software, will improve our capability to record, track, and measure FOIPOP requests from intake to completion. AccessPro is expected to reduce the use of paper processes and also be able to measure several key performance indicators. The numbers will continue to tell the same kinds of things is workload increasing, is government getting faster at responding, are we disclosing more information? The new system will tell all this with more accuracy and less effort. More and better data means improved data integrity, which means more precise performance measurement. New Redaction Software With the new case management tool came the ability to move to the electronic redaction of records. Throughout the year, IAP Administrators began moving away from manual redaction methods. This is introducing a new standard of consistency to the management of FOIPOP applications. Concurrent development of standardized internal processes and procedures will make this a smooth transition. The expectation is that we will move to full electronic redaction in Information Access and Privacy Services Annual Report

10 Looking Forward Information Access and Privacy Framework As expected, bringing all IAP resources under one roof is allowing IAP Services to cultivate consistency in all areas of service. The new framework will continue to foster this evenness, notably by standardizing corporate best practices and equipping a robust and skilled workforce with the suite of tools necessary to do their jobs. Over the past year, efforts focused on the elements of the framework that support the access to information program. In the coming year we will focus on the elements that support the privacy program. Work is already underway on such things as a renewed privacy policy, privacy breach protocol and privacy impact assessment tool for government departments, essential tools that help government to ensure it is respecting the privacy rights of Nova Scotians. We will also continue to improve our reporting on privacy practices and events. This work supports the plan to strengthen the information access and privacy program within government. Training, Education, and Awareness Program Rapid technological change, including the ease with which information is created, shared, and transported, and the increased emphasis on digital service delivery create new challenges for government employees who must understand how to apply basic legislative requirements and principles in an increasingly complex environment. Meanwhile, the public continues to demand increased openness and transparency on the part of government, and employees must understand how to satisfy these expectations while appropriately balancing the privacy rights of individuals. The creation of IAP Services, with its mandate to develop an Information Access and Privacy Framework for all of government, presents an opportunity to address access and privacy challenges in a proactive, planned and comprehensive manner. To meet these needs, IAP Services will develop a comprehensive training, education, and awareness program. The program will focus on privacy and access basic training for all Government of Nova Scotia employees, including those under personal services contracts, using a strategic and sustainable approach that is aligned with stakeholder needs. The intent is to develop and deliver a program that ensures that all employees are aware of the fundamental importance of access to information and privacy and the related obligations that govern their activities as employees of public bodies. Disclosure Log Increasing Accountability A steady increase in the volume of FOIPOP requests each year points to an increasing public desire for more government openness and transparency. In keeping with public demand for more proactive disclosure and the government s expressed desire for more transparency, Government will introduce a new product to Nova Scotians with the launch of a disclosure log for access to information/foipop requests. The log will be a publicly viewable online repository of requests that were completed and 4 Information Access and Privacy Services Annual Report

11 already sent to an applicant. The purpose is to improve accessibility for the public and free up resources for IAP Services to improve service in other areas as well. Applications eligible for posting will be assessed according to a strict set of criteria. Only general information requests will be posted, including items such as briefing notes, correspondence about a specified topic, or staff reports. No applicant will ever be identified when the response to their application is posted publicly, after it has been released to them. No response will be posted that contains personal information. Make a FOIPOP Request Online In January 2017, the government will launch an online product to make access to information easier for the public. Citizens will be able to create a user account that will allow them to make access to information requests online. Through that account, they will be able to submit their application, pay the application fee and any additional processing fees, and receive the public body s decision letter and responsive records all online. The same 30-day window required for the paper-based applications will be used to process requests online, although faster response times are possible at the front and back end of the process, since online requests may be received sooner and online disclosure is faster than disclosure through postal mail The Year in Numbers Understanding the Data The information in this report is categorized according to whether the public entity falls under the jurisdiction of the FOIPOP Act or Part XX of the Municipal Government Act. FOIPOP Act MGA Government Departments Other Public Bodies Municipal Entities FOIPOP applications managed by IAP Services Public bodies that manage their own FOIPOP applications Agencies, boards, and commissions (ABCs) NSHA and IWK Universities, colleges, and school boards Each manages its own MGA applications Municipalities Municipal police services Information Access and Privacy Services Annual Report

12 This year s Report includes statistics on access to information applications received by provincial government departments, agencies, boards, and commissions (ABCs) as well as universities, school boards, health authorities, municipalities, and municipal police services (MASH sector). ABCs and MASH-sector organizations typically manage and track their own FOIPOP applications either under the FOIPOP Act or the Municipal Government Act (MGA). However each year the provincial government extends the courtesy of including in its Annual Report the statistics submitted by these other public bodies and municipal entities. This year, some entities that reported last year did not do so, and vice-versa, lessening the comparability of the statistics. Other reasons they may not be directly comparable this year is because of the shift to the new fiscal-year reporting timeframe, resulting in these entities reporting for a 15-month period rather than a 12-month period. In , IAP Services will consult with ABCs and the MASH sector to determine if for future years they are able to join the new IAP system or would prefer to self-report. How Applications are Received and Processed The following diagram shows a high-level view of how applications are processed and explains some key terms you will see throughout the report. Decisions Submitted this year Total received Total completed } Granted in full Granted in part Denied No record Carried over Carried over Other Carried over Abandoned Transferred out 6 Information Access and Privacy Services Annual Report

13 The total received figure in any given year is mostly made up of applications submitted during the year but also includes those carried over (i.e., not completed from the previous year). The total completed figure for the year is the sum of all applications for which a decision was made. The decision can be any one of the following: Granted in full Granted in part Denied No record Other The relevant public body will release all requested information. Less than 100% of the requested information will be released. The application is denied by the target public body. The public body must provide an explanation to the applicant as part of the decision to not provide the record. (See the following section for more detail.) The requested information does not exist. This usually arises when the requested information is subject to one or more exclusions provided for in the FOIPOP legislation and either may or must be withheld (See the following section for more detail.) A note regarding in-part decisions: In many partial-disclosure decisions, all information is disclosed except for names or other personal information that must be removed to protect the privacy of a third party. (Personal information must not be disclosed to any person other than the person to whom it belongs.) The public body must categorize the decision as granted in part even if only one piece of personal information is redacted before sending the record to the applicant. The difference between total applications received and completed is made up of the following three outcomes, which are not considered decisions, and therefore, the application has not been completed. Carried over Abandoned Transferred out The application is not completed by December 31 or March 31 and has been carried over to the next reporting period. The application may be abandoned under several scenarios, including the following: The applicant has indicated to the relevant department that they no longer wish to proceed with the application. The applicant has not submitted the required fees for processing the application. The applicant has not responded to clarifying questions, which must be answered before the application can proceed. The application is valid but submitted to the wrong public body, and therefore has been transferred to the correct entity for processing. Information Access and Privacy Services Annual Report

14 Denied Applications When an application is denied, it is usually due to either an exemption under the applicable act or because another statute prevails over the FOIPOP Act or the Municipal Government Act. Exemptions The presumption under Section 2 of the FOIPOP Act is toward disclosure: Individuals have the right to access government records. However, that right is subject to certain exemptions. The exemptions are specifically laid out in the legislation and are limited to the following: information that could harm intergovernmental relations or information received in confidence from another government s. 12 information that would reveal the substance of the deliberations of the executive council s. 13 advice by or for a public body or minister s. 14 information related to law enforcement and security s. 15 information subject to solicitor/client privilege s. 16 information the release of which would have a detrimental financial or economic impact on Nova Scotia s. 17 health and safety s. 18 conservation s. 19 unreasonable invasion of personal privacy s. 20 (mandatory exemption) business confidential information s. 21 (mandatory exemption) Other Statutes Prevail Section s. 4 of the FOIPOP Act identifies legislation that prevails over the FOIPOP Act, restricting the disclosure of information such as maintenance-enforcement records and vital statistics. The list of prevailing statutes can be found in subsection 4A(2) of the FOIPOP Act and subsection 464A(2) in Part XX of the Municipal Government Act. 8 Information Access and Privacy Services Annual Report

15 Other Decisions The term other in the context of decisions covers several less-common outcomes, most of which fall under the category of exclusions: Exclusions The FOIPOP Act does not apply to the following kinds of information in the custody or control of a public body. This information is therefore excluded from the jurisdiction of the act: Published information, material available for purchase, court records, and material that is a matter of public record Archival material, including information at the Public Archives of Nova Scotia, that has not been placed there by a government body Records created or collected by the Conflict of Interest Commissioner, the Ombudsman or the Review Officer relating to their statutory functions A record of a question that is to be used on an examination or test A record relating to a prosecution if all proceedings are incomplete Private records deposited at the Public Archives of Nova Scotia Non-Exclusions The existence of a record cannot be confirmed or denied, where the record would contain information exempted pursuant to Section 15, if the record were in the custody or control of a public body s. 7(2) of the FOIPOP Act. The information will be made available in the following 30 days s. 7(4) of the FOIPOP Act Information Access and Privacy Services Annual Report

16 FOIPOP Government Departments FOIPOP Applications Received Per Government Department CY 2014 CY 2015 FY FOIPOP Applications Received Government Departments Type of Information Requested General Personal Personal/General Total Request by Applicant Type Academic Business Media Other Political Party Private Individual Public Interest Group Total Note: CY Calendar Year, FY Fiscal Year (April 1, 2015 March 31, 2016) 10 Information Access and Privacy Services Annual Report

17 Information Types FOIPOP Government Departments FY % 17% 5% CY % 16% 6% CY % 20% 26% General Personal Personal/General Applicant Types FOIPOP Government Departments Academic 1% 1% 1% Business Media Other Political Party Private Individual Public Interest Group 3% 2% 2% 5% 6% 8% 8% 11% 10% 16% 32% 34% 34% 0% 5% 10% 15% 20% 25% 30% 35% 18% 20% 26% 28% 35% FY CY 2015 CY 2014 Information Access and Privacy Services Annual Report

18 FOIPOP Applications Received Per Government Department Department CY 2014 CY 2015 FY Aboriginal Affairs Agriculture Business Communications Nova Scotia Communities, Culture and Heritage Community Services Economic and Rural Development and Tourism Education and Early Childhood Development Energy Environment Executive Council Office Finance and Treasury Board Fisheries and Aquaculture Health and Wellness Immigration Intergovernmental Affairs Internal Services Justice Labour and Advanced Education Municipal Affairs Natural Resources Nova Scotia Business Inc.* Planning and Priorities Office Premier's Office Public Prosecution Service Public Service Commission Seniors Service Nova Scotia Tourism Nova Scotia* Transportation and Infrastructure Renewal Information Access and Privacy Services Annual Report

19 Please Note on page 12: Economic and Rural Development and Tourism ceased as a department in April Planning and Priorities Office was combined into the Executive Council Office in January * These crown corporations are included with the departmental statistics because they are served by IAP services. FOIPOP Applications Completed Per Government Department CY 2014 CY 2015 FY FOIPOP Applications Completed Government Departments Decisions Granted in Full Granted in Part Denied No Record Other Total Response Time 30 Days Days Days Total Abandoned Transferred Out Carried Over Total Information Access and Privacy Services Annual Report

20 Decisions FOIPOP Government Departments Granted in Full 14% 14% 13% Granted in Part 50% 51% 61% Denied 1% 1% 2% No Record 23% 33% 32% Other 2% 1% 2% 0% 10% 20% 30% 40% 50% 60% 70% FY CY 2015 CY 2014 Response Times FOIPOP Government Departments CY 2014 CY 2015 FY % 7% 15% 4% 13% 3% 78% 81% 84% 30 days days 61+ days 14 Information Access and Privacy Services Annual Report

21 FOIPOP Other Public Bodies Other public bodies that receive FOIPOP applications track their own applications independent of the government departments. The data presented in this section is representative of the other public bodies that reported information to IAP Services for a 15-month period covering January 1, 2015 to March 31, In some instances, the total number of decisions may not match the total number of applications received due to applications that are abandoned, transferred or carried over to the next reporting period. FOIPOP Applications Received Per Other Public Body Agencies, Boards, and Commissions January 1, 2015 March 31, 2016 Workers Compensation Board of Nova Scotia 17 Nova Scotia Human Rights Commission 7 Waterfront Development Corporation 5 Serious Incident Response Team 3 Trade Centre Limited 1 Elections Nova Scotia 0 Halifax-Dartmouth Bridge Commission 0 Nova Scotia Public Service Long Term Disability Plan Trust Fund 0 Nova Scotia Securities Commission 0 Nova Scotia Utility and Review Board 0 Workers Compensation Appeals Tribunal 0 Total 33 Health Authorities January 1, 2015 March 31, 2016 Nova Scotia Health Authority 69 IWK 9 Total 78 Information Access and Privacy Services Annual Report

22 Universities, Colleges, and School Boards January 1, 2015 March 31, 2016 Halifax Regional School Board 39 Cape Breton-Victoria Regional School Board 17 Annapolis Valley Regional School Board 15 Mount Saint Vincent University 12 Chignecto-Central Regional School Board 11 Saint Mary s University 11 Nova Scotia Community College 10 St. Frances Xavier University 7 Cape Breton University 5 Strait Regional School Board 5 Université Sainte-Anne 4 University of King s College 4 Nova Scotia College of Art and Design 3 Total 143 FOIPOP Applications Completed Per Other Public Body Agencies, Boards, and Commissions January 1, 2015 March 31, 2016 Workers Compensation Board of Nova Scotia 17 Nova Scotia Human Rights Commission 5 Waterfront Development Corporation 2 Serious Incident Response Team 3 Trade Centre Limited 1 Elections Nova Scotia 0 Halifax-Dartmouth Bridge Commission 0 Nova Scotia Public Service Long Term Disability Plan Trust Fund 0 Nova Scotia Securities Commission 0 Nova Scotia Utility and Review Board 0 Workers Compensation Appeals Tribunal 0 Total Information Access and Privacy Services Annual Report

23 Health Authorities January 1, 2015 March 31, 2016 Nova Scotia Health Authority 50 IWK 6 Total 56 Universities, Colleges, and School Boards January 1, 2015 March 31, 2016 Halifax Regional School Board 26 Cape Breton-Victoria Regional School Board 8 Annapolis Valley Regional School Board 13 Mount Saint Vincent University 10 Chignecto-Central Regional School Board 8 Saint Mary s University 11 Nova Scotia Community College 10 St. Frances Xavier University 6 Cape Breton University 4 Strait Regional School Board 0 Université Sainte-Anne 4 University of King s College 4 Nova Scotia College of Art and Design 2 Total 106 Information Access and Privacy Services Annual Report

24 Municipal Government Act (MGA) Municipal entities are subject to Part XX of the Municipal Government Act, which is substantially similar to the FOIPOP Act. These entities track their own applications for access to information independent of government departments. The data presented in this section is representative of the municipal entities that reported information to IAP Services for a 15-month period covering January 1, 2015 to March 31, In some instances, the total number of decisions may not match the total number of applications received due to applications that are abandoned, transferred or carried over to the next reporting period. Applications Received per Municipal Entity Municipalities and Municipal Services January 1, 2015 March 31, 2016 Halifax Regional Municipality 553 Halifax Regional Police 297 Municipality of the District of Chester 25 Halifax Regional Water Commission 15 Cape Breton Regional Municipality 11 Town of Amherst 6 Municipality of the District of Lunenburg 5 Town of Wolfville 4 Municipality of the County of Annapolis 3 Town of Bridgewater 3 Municipality of the County of Pictou 2 Town of Middleton 2 Town of Shelburne 2 Municipality of the District of Argyle 1 Town of Digby 1 Town of Yarmouth 1 Municipality of the District of Shelburne 0 Municipality of Yarmouth 0 Annapolis Royal Police Department 0 Total Information Access and Privacy Services Annual Report

25 Applications Completed Per Municipal Entity Municipalities and Municipal Services January 1, 2015 March 31, 2016 Halifax Regional Municipality 539 Halifax Regional Police 289 Municipality of the District of Chester 25 Halifax Regional Water Commission 13 Cape Breton Regional Municipality 10 Town of Amherst 6 Municipality of the District of Lunenburg 4 Town of Wolfville 2 Municipality of the County of Annapolis 3 Town of Bridgewater 2 Municipality of the County of Pictou 1 Town of Middleton 2 Town of Shelburne 1 Municipality of the District of Argyle 1 Town of Digby 1 Town of Yarmouth 0 Municipality of the District of Shelburne 0 Municipality of Yarmouth 0 Annapolis Royal Police Department 0 Total 899 Information Access and Privacy Services Annual Report

26 Routine Access Requests The statistics in this section cover routine access requests made to government departments only. CY 2014 CY 2015 FY Applications Received Applications Completed Decisions Granted in Full Granted in Part Denied No Record Other Response Time 30 Days Days days FOIPOP and MGA Fees The figures in this section reflect fee estimates and may not reflect the actual amount of fees collected. FOIPOP CY 2014 CY 2015 FY Government Departments $23,494 $32,543 $32,278 CY 2014 January 1, 2015 March 31, 2016 FOIPOP Other Public Bodies $1582 $1740 MGA Municipalities and Municipal Services $4077 $3542 Total $5659 $ Information Access and Privacy Services Annual Report