Information and Privacy Commissioner of Nunavut Annual Report 2020-21 0 OFFICE OF THE INFORMATION AND PRIVACY COMMISSIONER OF NUNAVUT ANNUAL REPORT 2021-2022 Information and Privacy Commissioner of Nunavut Annual Report 2021-22 1 Table of Contents Commissioner’s message...........................................................2 The law needs to be amended..................................................2 The GN needs to do better......................................................3 There are bright spots ...........................................................3 What we do ..........................................................................5 Number and type of files in 2021-22 .............................................6 New files ...........................................................................6 Requests for comment ...........................................................8 Accomplishments and challenges in 2021-22 ...................................9 We have zero backlog ............................................................9 We have a higher public profile ................................................9 Municipal ATIPP is back on the agenda...................................... 10 We closed the 2019 ransomware file ........................................ 10 We have not been consulted on the Police Act ............................ 11 We helped shut down an unprotected network drive ..................... 12 Discretion is still not being exercised........................................ 13 We employed two articling students......................................... 13 Review Reports in 2021-22 ...................................................... 14 Five most significant Review Reports........................................ 15 Recommendations that were not accepted................................. 18 Priorities for my term ............................................................ 21 Information and Privacy Commissioner of Nunavut Annual Report 2021-22 2 Commissioner’s message This report covers the period from April 1, 2021, to March 31, 2022. This was my first full fiscal year as Information and Privacy Commissioner. My appointment began on January 11, 2021, and expires on January 10, 2026. The law needs to be amended Nunavut’s access and privacy law is now 25 years old — older than Nunavut itself. It needs to be rewritten. It was barely adequate when it came into force in 1996. In 2022, it is not adequate at all. The inadequacy of Nunavut’s ATIPPA is especially glaring on the privacy side. Think about where information technology was in 1996, then think about where it is today. Information technology is vastly faster, more widespread, and more intrusive than it was in 1996. We live in a world of surveillance and cyberattacks. Nunavut’s legislative response to privacy has not kept up. Graham Steele Information and Privacy Commissioner of Nunavut Annual Report 2021-22 3 The GN needs to do better My only hesitation in recommending changes to the ATIPP law is that the GN is consistently unable to follow the existing law, never mind a new law that requires it to be better, smarter, and faster. Every public body that is part of the GN has obligations under the ATIPP law. There are rules to follow, deadlines to meet, information to disclose, and privacy to protect. Too many public bodies are falling short — not all, but too many. To be blunt, they are failing to meet their legislated obligations. The roots of the problem are deep. Good ATIPP work requires training, experience, and judgment, as well as management support. For the ATIPP Coordinator positions, there are too many vacancies, too much turnover, not enough training, and little or no management support. The problem is compounded by the fact that there are no consequences for poor performance. The ATIPPA says I can issue recommendations only, which a public body can ignore. I cannot enforce deadlines. I cannot enforce disclosure. I cannot enforce anything. It is no wonder, then, that some public bodies approach their ATIPP obligations with less than full commitment. There are bright spots The ATIPP system in Nunavut does not function well as a whole, but I want to acknowledge a few public bodies that are doing well. The Department of Health continues to be the GN’s leader on ATIPP. Files are handled with attention to details and deadlines. The department’s ATIPP co-ordinator is experienced and has good judgment. Management understands its obligations. Errors occur, of course, because the department’s operations are so multi-faceted; but the department listens Information and Privacy Commissioner of Nunavut Annual Report 2021-22 4 and learns, and strives to improve. If every public body approached ATIPP like Health does, we would be making progress. Over the past year, I have seen good ATIPP work on individual files by the Department of Culture and Heritage, and also by Nunavut Arctic College. The Department of Justice has two experienced people who do good ATIPP work. The quality of their work is probably enhanced by their ready access to GN lawyers with ATIPP experience. I have also been impressed by the work of Yuri Podmoroff, the Territorial ATIPP Manager. Yuri offers training and guidance to ATIPP coordinators, maintains cross-government ATIPP records, and acts generally as the GN’s point person on ATIPP matters. Within the limited resources he has, Yuri tries to keep the ATIPP ship afloat. It is not easy. In this report, I am not asking for more resources for my office, which (if I may say) functions well. The single best thing the GN can do, if it wants the ATIPP system to work, is to support its ATIPP Coordinators. And the best way to do that is for the GN to listen to and support its own Territorial ATIPP Manager. He has good ideas about how to make ATIPP work in the Nunavut context. Now he needs the resources, and the management support, to implement them. Why does it matter? Because good ATIPP is part of good government, and Nunavummiut deserve good government. It really is that simple. Graham Steele Information and Privacy Commissioner Information and Privacy Commissioner of Nunavut Annual Report 2021-22 5 What we do The Information and Privacy Commissioner is an independent officer of the Legislative Assembly of Nunavut, appointed under section 61 of the Access to Information and Protection of Privacy Act. Everything we do is derived from the ATIPPA. The ATIPPA gives the public a right of access to records held by the Government of Nunavut, with limited exceptions. The ATIPPA also allows Nunavummiut to know what information the GN holds about them, and to correct it if it’s wrong. The ATIPPA also protects the privacy of Nunavummiut by preventing the unauthorized collection, use or disclosure of personal information. The primary role of the Commissioner is to ensure the GN is following the ATIPPA correctly. Usually that is done at the request of a citizen who is dissatisfied with the GN’s response to a request for information, or who believes their privacy has been breached. If there is a complaint, the Commissioner looks at the law and the evidence, and then makes recommendations to the GN about how to improve their handling of information. The Commissioner also does research and offers comments on access and privacy matters involving the GN. Information and Privacy Commissioner of Nunavut Annual Report 2021-22 6 Number and type of files in 2021-22 New files In the 2021-22 fiscal year, the NUIPC opened 73 new files (2020-21: 64). Table 1 shows the main issue raised by the files opened in 2021-22: Table 1. Nature of Case Nature of Case 21-22 20-21 Review of disclosure 15 12 Review of refusal to disclose 3 7 Review of time extension 4 3 Review of fees 2 1 Review of request for correction of personal information 1 0 Privacy breach notification 14 13 Privacy breach complaint 8 11 Self-initiated investigation 5 5 Request for comments 14 10 Administrative 7 2 Total 73 64 Information and Privacy Commissioner of Nunavut Annual Report 2021-22 7 Table 2 shows the public body involved in the 73 files that were opened: Table 2. Public bodies Public Body 21-22 20-21 Health 20 24 Human Resources 10 4 Justice 5 4 Nunavut Housing Corporation 5 1 Community & Government Services 4 6 Economic Development & Transportation 4 0 Education 3 10 Executive & Intergovernmental Affairs 3 1 Family Services 3 2 Environment 2 0 Integrity Commissioner 2 0 Nunavut Arctic College 2 1 Representative for Children & Youth 2 2 Culture & Heritage 1 Elections Nunavut 1 2 Languages Commissioner 1 1 Finance 0 2 Workplace Safety & Compensation Commission 0 1 None 2 3 Other 3 0 Total 73 64 Information and Privacy Commissioner of Nunavut Annual Report 2021-22 8 Requests for comment The NUIPC provides comments to public bodies seeking advice on the interpretation of the ATIPPA. The NUIPC also provides comments to bodies of the Legislative Assembly on legislative proposals or policy issues. During the year, comments on policy proposals and/or advice on specific situations were provided to the following public bodies:  Community and Government Services  Education  Executive and Intergovernmental Affairs  Elections Nunavut  Health  Justice  Representative for Children and Youth  Integrity Commissioner  Languages Commissioner In addition, presentations on the ATIPPA were made to the Nunavut Association of Municipalities (NAM) and to the city council of the City of Iqaluit. Information and Privacy Commissioner of Nunavut Annual Report 2021-22 9 Accomplishments and challenges in 2021-22 We have zero backlog In last year’s Annual Report, I noted that this office had eliminated its backlog. I am pleased to report that, as of March 31, 2022, the backlog is still zero. Our decisions are typically issued 1-3 weeks after all relevant material has been submitted by the parties. That compares to delays of months, and sometimes years, in most other Canadian jurisdictions. We have a higher public profile Now that the office is established in Nunavut, it is easier to have routine interactions with MLAs, journalists, and other citizens. As a result, the profile of the office is higher. The NUIPC website (www.atipp-nu.ca) has been revamped and is now available in Nunavut’s four official languages. The new website was designed to be simple and to load quickly, given the challenges Nunavummiut face with internet connections. Over the past year, I have done interviews with journalists for television, radio, and print. There has been regular coverage of my more significant Review Reports and my Annual Report, and my comments have been sought on other stories involving access and information. I also established a Twitter account (@nu_privacy) and have used it to publicize new decisions and to comment on access and privacy issues relevant to Nunavummiut. Information and Privacy Commissioner of Nunavut Annual Report 2021-22 10 Municipal ATIPP is back on the agenda Media reports about my last annual report sparked renewed interest in the possibility of bringing Nunavut’s municipalities under the umbrella of the ATIPPA. The Iqaluit water emergency in late 2021 highlighted the issue. In 2017, the Nunavut Legislative Assembly amended the ATIPPA to make it possible to include municipalities. All that was needed was a regulation to add municipalities to the list of “public bodies”. That never happened. Five years later, municipalities are still not covered by Nunavut’s access and privacy law. At the invitation of Mayor Kenny Bell of Iqaluit, I gave a presentation on municipal ATIPP to Iqaluit City Council on November 9, 2021. Mayor Bell is also the president of the Nunavut Association of Municipalities (NAM), and at his request I gave a presentation to NAM’s annual meeting. I then had discussions with the Department of Community and Government Services, which is the department that will ultimately provide the necessary support for municipalities. Extending the ATIPPA to municipalities is a good idea, and overdue. But it must be handled carefully. Nunavut’s municipalities are small and their resources are limited. We do not want to set up the municipalities for failure. I am ready to assist, in whatever way I can, as CGS works with NAM and the municipalities. We closed the 2019 ransomware file In last year’s Annual Report, I noted that there had still been no public accounting of the ransomware attack on the GN in November 2019. I pledged to continue this office’s investigation. During this fiscal year, I decided to end my investigation, without issuing a report. I considered the following factors: Information and Privacy Commissioner of Nunavut Annual Report 2021-22 11  The GN tabled a report in the Legislative Assembly on June 3, 2021, about the ransomware attack. Although the report is more self￾congratulatory than analytical, it is a public report.  A forensic report obtained by the GN concluded there had been no theft (exfiltration) of personal information. I have read the report and find it credible.  After Review Report 21-191, which I quoted in last year’s annual report, there were no more access files in which “ransomware” was cited as the reason for non-disclosure.  There were other, more current files on which I wanted CGS to focus. Ransomware is an ongoing issue requiring ongoing vigilance. In 2021 there were at least two ransomware attacks on private-sector companies under contract to the GN. Based on what we know so far, it appears that the personal information of Nunavummiut was not compromised in either case. We have not been consulted on the Police Act In June 2021, the Police Act (then known as Bill 53) was working its way through the Legislative Assembly. Bill 53 was a re-working and re-naming of the Royal Canadian Mounted Police Act, which governed the relationship between the GN and the RCMP. The RCMP is Nunavut’s only police force. The role of the RCMP, and especially accountability for the use of force, is a sensitive issue. On June 7, a series of government commitments was read into the record of the Legislative Assembly. One of the commitments was to consult with the Information and Privacy Commissioner (Hansard, page 44): Information and Privacy Commissioner of Nunavut Annual Report 2021-22 12 A commitment by the department to formally consult with the Office of the Information and Privacy Commissioner concerning proposed agreements with independent investigative bodies and other entities; … I wish to draw to the attention of the Legislative Assembly that, as of the end of March 2022, there was no consultation with my office on the topic promised in the Legislative Assembly. We helped shut down an unprotected network drive On July 20, 2021, a GN employee contacted my office to express concern about documents they were able to see on the so-called “V-drive” of their networked computer. The files were unrelated to the employee or their department. From the file names alone, it appeared likely the documents contained sensitive personal information. As a result of this call, I launched a privacy investigation into the V-drive, with the assistance of CGS and the Territorial ATIPP Manager. The GN had a separate V-drive for each of Nunavut’s 25 communities, plus one for GN staff in Ottawa. The purpose of the V-drives was to facilitate cross-departmental collaboration within a community. When used correctly, the V-drives were a useful tool. Unfortunately, the V-drives were often used incorrectly. Many files were posted without access being restricted to those who had an operational need to see them. We ascertained quickly that many hundreds of files on the V-drives were privacy-invasive and needed to be removed. The privacy breaches covered multiple departments and covered sensitive topics like personal health information, individual student records, child protection, corrections, and payroll. The privacy-invasive files were taken down within days. CGS later decommissioned the V-drives entirely, and replaced them with a different Information and Privacy Commissioner of Nunavut Annual Report 2021-22 13 collaboration tool. That was the right thing to do. The V-drives were a privacy disaster. I would like to thank CGS and the Territorial ATIPP Manager for their diligent work on this file. I would also like to thank the GN employee who tipped me to the problem. They looked at the V-drive and knew they should not be able to see these sensitive files. And then they picked up the phone and did something about it. Discretion is still not being exercised In my last annual report, I noted that the GN is routinely breaking the ATIPPA by failing to exercise its discretion in access cases. The ATIPPA lays down minimum rules for disclosure. In most cases, the GN could release more than the minimum. That is what it means to “exercise discretion”: to choose to release as much information as possible. Over the past year, I have seen no improvement in the way the GN exercises discretion. Public bodies are still routinely failing to follow the law. We employed two articling students In the 2021-22 fiscal year, we were pleased to offer a two-month articling rotation to two 2021 graduates of the Nunavut Law Program. It is a small but concrete way that our office could help them along the path to bar admission. Nunavut will be stronger with this cohort of homegrown lawyers. Our thanks and best wishes to both students who articled with us, and to all graduates of the Nunavut Law Program. Information and Privacy Commissioner of Nunavut Annual Report 2021-22 14 Review Reports in 2021-22 The most visible products of our office are the final decisions, commonly referred to as Review Reports. Like a judge’s decision in court, our Review Reports explain the legal principles and apply them to the facts of a given case. They lay down the analytical framework that we will follow in future decisions, and that we expect GN public bodies to follow. The full text of the Review Reports is available on the NUIPC website (atipp-nu.ca) and also on the Canadian Legal Information Institute website (canlii.org). In 2021-22 there were 21 Review Reports. That compares with 27 in 2020- 21. Last year’s high number was due to the former Commissioner’s commitment to reduce the backlog before she retired. As I mentioned on page 14 of last year’s report, we knew this year’s number would likely be lower. Table 3 shows the number of Review Reports per year in the last ten years. Fiscal Year Reports 2021-22 21 2020-21 27 2019-20 19 2018-19 6 2017-18 27 2016-17 18 2015-16 7 2014-15 10 2013-14 5 2012-13 5 Information and Privacy Commissioner of Nunavut Annual Report 2021-22 15 Five most significant Review Reports I would like to draw the Legislative Assembly’s attention to the five most significant Review Reports. They are significant either because of the legal issue they raise, or because of what the case shows about ATIPPA administration. Review Report 22-213 Department of Health (Re), 2022 NUIPC 4 (CanLII) The Applicant requested annual tuberculosis statistics, broken down by community, age and gender. The Department of Health refused under section 23 of the ATIPPA to disclose the statistics, because the small numbers might permit identification of individuals. The department also argued that the statistics should be withheld because TB is stigmatized. The Commissioner finds that there is no serious possibility of re￾identification. Section 23 therefore does not apply. The issue of stigma is real, but Health offers insufficient evidence, and does not relate the issue of stigma to any exemption enumerated in the ATIPPA. The Commissioner recommends the requested statistics be disclosed, with some restrictions for cross-tabulations. The Commissioner also recommends that Health consider a consultation process to explore how Inuit Qaujimajatuqangit and Inuit societal values may inform the department’s decisions on the release of medical statistics, including TB statistics. Why is this decision significant? It explains how the Department of Health should handle medical statistics. It also underlines that Inuit Qaujimajatuqangit and Inuit societal values should be incorporated into decision-making about medical statistics. Information and Privacy Commissioner of Nunavut Annual Report 2021-22 16 The minister’s decision, in response to this Review Report, was to reject most of the recommendations. The minister repeated that there is, in the department’s opinion, a risk of re-identification and a risk of stigma, so community-level TB statistics will not be disclosed. Territory-level statistics by age and gender may be disclosed in future. Inuit societal values will be incorporated into health-specific privacy legislation, which is in the process of development. Review Report 22-211 Department of Community and Government Services (Re), 2022 NUIPC 2 A network drive used by the GN permitted users to share files between departments within the same community. There was no active control over what was posted. The Commissioner was tipped to a large amount of privacy-invasive material on the drive. In response, the GN immediately removed the most obviously privacy-invasive material, and later decommissioned the drive entirely. The Commissioner requested that each public body prepare a privacy breach report for files originating with their employees. Only two did so. The Commissioner recommends that each public body with material on the V: drive complete a privacy breach assessment and, where appropriate, submit a privacy breach report to the Commissioner. (As of the end of the fiscal year, those reports have not been submitted.) Why is this decision significant? It shows that privacy can be breached at the GN network level, as well as at the individual level. Information and Privacy Commissioner of Nunavut Annual Report 2021-22 17 Review Report 21-208 Department of Health (Re), 2021 NUIPC 27 (CanLII) The Applicant, a journalist, requested certain information from the Department of Health about Iqaluit’s water emergency. The department estimated the fee to be $295 for staff time and photocopying. The Applicant requested a fee waiver. The department declined. The Applicant applied for review. The Commissioner finds the fee for staff time is supported, but the fee for photocopying is not. In any event, the Commissioner finds it would be fair to waive the whole fee, given the subject-matter, the role of journalists, and overlapping applications received by the department. Why is this decision significant? It underlines the important role that journalists have in holding the GN accountable. It also sets out the criteria for deciding whether to waive access fees. Review Report 21-207 Nunavut Housing Corporation (Re), 2021 NUIPC 26 (CanLII) The Applicant requested policy and procedure documents from the Nunavut Housing Corporation (NHC) and local housing organizations (LHOs). NHC disclosed records of its own policies and procedures, and some records from the LHOs. The Applicant believed the disclosure was incomplete, and requested review. The Commissioner finds NHC is responsible for coordinating responses from LHOs. The Commissioner also finds the search for responsive records was incomplete, and makes recommendations concerning the public availability of NHC and LHO policies. Why is this decision significant? It supports the idea that GN policy statements should be easily available to Nunavummiut, in Nunavut’s official languages. Information and Privacy Commissioner of Nunavut Annual Report 2021-22 18 Review Report 21-202 Department of Education (Re), 2021 NUIPC 21 (CanLII) The Applicant requested records from the previous five years about the Student-Educator Ratio. The Department of Education took a 60 business￾day extension, citing the large volume of records. The Applicant sought review. The Commissioner finds the extension is unreasonable. The department did not make diligent efforts during the initial response period, and provided no evidence of operational interference. The Commissioner recommends the records be produced within 30 days. Why is this decision significant? It explains under what circumstances a time extension is justified. Recommendations that were not accepted Section 68(1) of the ATIPPA requires that I provide to the Legislative Assembly information about any Review Reports for which the head of a public body has not accepted the Commissioner’s recommendations. The ATIPPA says that the head of a public body (usually the minister of a department) must respond to a Review Report. The head is not required to accept the Commissioner’s recommendations. The head may make any decision the head thinks is proper. All responses are posted to the NUIPC website. In the past year, there were only three times (out of 20 Review Reports) when my recommendations were not accepted in full. In another case, a recommendation was taken “under consideration”, so it was neither accepted nor rejected. Information and Privacy Commissioner of Nunavut Annual Report 2021-22 19 Review Report 22-214 Nunavut Housing Corporation (Re), 2022 NUIPC 5 (CanLII) The Applicant requested records about three housing construction tenders cancelled by Nunavut Housing Corporation. A limited number of records were disclosed. The Applicant requested review. The Commissioner finds that most exemptions claimed do not apply. The Commissioner recommends the initial disclosure package be disclosed without redactions. The Commissioner recommends that NHC review the e-mail package with a view to severing information that can be disclosed. The Commissioner recommends NHC consider discretionary release of the requested records. Minister’s response: Some recommendations accepted, some rejected. Review Report 22-213 Department of Health (Re), 2022 NUIPC 4 (CanLII) Please see my discussion of this Review Report in the previous section. It concerns the disclosure of tuberculosis statistics. The minister’s response was to reject most of the recommendations. Review Report 21-204 Department of Justice (Re), 2021 NUIPC 23 (CanLII) The Applicant requested records about a fire at the Baffin Correctional Centre in Iqaluit. The Department of Justice disclosed 800 pages of records, with extensive redactions. The Applicant asked the Commissioner to review the redactions. The Commissioner makes recommendations for further disclosure, and recommends the department show how it exercises its discretion for discretionary exemptions. Information and Privacy Commissioner of Nunavut Annual Report 2021-22 20 Minister’s response: Some recommendations accepted, some rejected. Review Report 21-203 Department of Education (Re), 2021 NUIPC 22 (CanLII) The Applicant, a teacher, filed numerous requests for information related to an employee-relations meeting with school management in December 2019. One request was for records from the time leading up to the meeting. At first the Department of Education did not respond to this request, then it did respond but failed to produce the records. The Applicant filed for review. The Commissioner finds the department did not conduct a diligent search. The Commissioner recommends the department review the capacity, staffing, and training of its ATIPP function. Minister’s response: One recommendation accepted. The department “will continue to work with” the Territorial ATIPP Manager. One recommendation taken “under consideration”. Information and Privacy Commissioner of Nunavut Annual Report 2021-22 21 Priorities for my term I concluded my last annual report by stating my six priorities. I repeat them here. My term as Information and Privacy Commissioner runs from January 11, 2021, to January 10, 2026. I have six things I would like to accomplish in that period:  Run a high-functioning office that makes good decisions quickly, and which operates as an information and privacy resource both for GN employees and for citizens.  Amend the ATIPPA to give the Commissioner the power to order the disclosure of documents. This could and should be done right away. About half of Canadian jurisdictions already have this power. The Northwest Territories did it last year. This is a simple amendment that will have an immediate, significant, positive effect on the operation of the ATIPPA in Nunavut.  Review the ATIPPA. Nunavut is still working with a first-generation ATIPP law. The foundation of our ATIPPA goes back to pre-division days. It is no longer adequate to deal with modern government and modern technology.  Enact health-specific information legislation. This is a long-standing recommendation of the former Commissioner. The ATIPPA is inadequate to deal with information and privacy in the health system. Every other Canadian jurisdiction has health-specific legislation. There is no reason that Nunavut should be so far behind.  Gradually increase the capacity of the office so that it can handle the increase in work that will come with health-specific information legislation, and also with the extension of the ATIPPA to Nunavut’s municipalities. Information and Privacy Commissioner of Nunavut Annual Report 2021-22 22  Groom a successor who is Inuk or a long-term Northerner. I believe this position should eventually be filled by someone who is fluent in Inuktut and is able to move the work of this office forward according to the spirit of Inuit Qaujimajatuqangit. My success as Information and Privacy Commissioner will be measured by whether, at the end of my term, those six priorities have been accomplished. None of these priorities is entirely in my control. Making progress on all of them will require the active commitment and cooperation of the Executive Council and members of the Legislative Assembly.