Annual Report on the Administration of the Privacy Act 2025-2026

1. Introduction

The Privacy Act (R.S.C. 1985, c. P-21, the Act) was proclaimed into force on July 1, 1983. It extends the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and provides individuals with a right of access to that information.

Section 72 of the Act requires each head of a federal government institution to submit a report to Parliament on the administration of the Act within their institution during the fiscal year. We are pleased to provide the following Annual Report to Parliament on the Administration of the Privacy Act in accordance with section 72. It provides an overview on the activities of the Canadian Space Agency (CSA) during the reporting period of April 1, 2025 to March 31, 2026.

The CSA is not reporting on behalf of wholly owned subsidiaries or non-operational institutions.

2. Organizational Structure

The Access to Information and Privacy (ATIP) Office is a member of the Information Management and Information Technologies Directorate (IM-IT). The IM-IT Directorate is led by the Chief Information Officer who reports to the Vice-President Corporate Strategy and Innovation, and Chief Financial Officer. The Access to Information and Open Government Coordinator is overseen by the Director of Cybersecurity and Information Management.

The ATIP Office is the central coordinating office for all requests received by the CSA under the Access to Information Act and the Privacy Act. It provides advice to senior management on the implementation of statutes and prepares reports to Parliament, the Treasury Board Secretariat (TBS) and senior management. The ATIP Office also represents the CSA in complaints and investigations conducted by the Information Commissioner and Privacy Commissioner of Canada, and in any Federal Court application arising from ATIP matters.

The main functions of the CSA ATIP Office are ATIP Operations and Privacy. Analysts assigned to ATIP Operations coordinate and process the CSA's ATIP requests. These analysts are responsible for coordinating with sectors and performing a "line-by-line" review of records. Conversely, the analyst assigned to Privacy provides privacy recommendations and expertise within the CSA. The analyst leads the horizontal implementation of departmental privacy policies, conducts risk analyses including privacy impact assessments and privacy protocols for non-administrative purposes; as well as the prevention and management of privacy breaches.

As of March 31, 2026, the ATIP Office was comprised of 5 full-time employees which include: 1 ATIP coordinator, 2 senior officers, 2 analysts and 1 consultant.

3. Delegation Order

Under the Act, the head of the CSA is the Minister of Industry and Minister responsible for Canada Economic Development for Quebec Regions. Decision-making responsibility for the application of the various provisions of the Access to Information Act and the Privacy Act have been formally established and are outlined in the departmental Delegation of Authority Instrument found in the Annex of this report.

The Delegation Order in effect during the 2025-2026 reporting period was modified and approved in October 2025. The instrument identifies powers that are delegated to the Chief Information Officer, Director of Cybersecurity and Information Management, and the Access to Information and Open Government Coordinator.

4. Performance in accordance with the Privacy Act, 2025-2026

During the 2025–2026 fiscal year, the CSA ATIP Office received a total of 18 requests for personal information under the Privacy Act. Of these, 12 were submitted through the ATIP Online Request Service, while the remaining 6 were received by email. This represents an increase of 11 requests compared to the previous fiscal year.

Over the course of the year, the CSA completed 19 requests under the Act, achieving a compliance rate of 95% within statutory time limits. At the conclusion of the 2025-2026 reporting period there was 1 request carried forward to the next reporting period within legislated timelines.

The following table illustrates the trend in number of requests received under the Privacy Act from 2021-2022 to 2025-2026:

5. Training and Awareness

In addition to managing requests the ATIP Office provides guidance and advice on complying with the Act. This guidance is presented to all CSA employees but also to targeted professional groups such as: Human Resources, Information Technology, Contracting and Procurement, etc. This ensures knowledge of common ATIP principles but is also tailored to the mandate of different CSA sectors.

This year the CSA benefited from the services of a consultant to deliver ATIP awareness training throughout the Agency. More than 230 employees participated in 7 bilingual courses which covered the following topics:

• Privacy Compliance Exercise;
• Privacy consideration in Artificial Intelligence;
• Privacy and Compliance with TBS Direction on Prescribed Attendance in the Workplace;
• Advice on recordings (cameras, MS Teams);
• Access to Information 101; and
• Privacy 101.

The purpose of these training sessions was to raise awareness concerning the role of employees and their responsibilities as they relate to the handing of personal information and the processing of privacy and access requests.

Looking ahead to next fiscal year, the ATIP Office collaborated with the CSA Learning team to develop a mandatory Access to Information and Privacy training course. This work included drafting course materials and developing content to enhance employee awareness of their responsibilities under the Access to Information Act, Privacy Act and related policies and procedures. The course will be hosted on the Canada School of Public Service (Brightspace) platform and will be rolled out to all employees of the CSA beginning in June 2026.

6. Policies, Guidelines and Procedures

In the reporting period of 2025-2026, the ATIP Office updated the Privacy Awareness Plan (2025-2029). The purpose of this framework is to guide the advancement of Privacy awareness at the CSA. Within this framework, 5 principles were identified in the Privacy Action Plan and are as follows:

1. Program Design and Delivery;
2. Employee Outreach;
3. Internal and External Controls;
4. Risk Management and Compliance; and
5. Management of Privacy Breaches.

In each of the 5 principles mentioned above, the CSA ATIP Office identified multiple short, medium, and long-term goals for each principle. In 2025-2026, the CSA ATIP office worked towards the implementation of short-term goals identified in the Privacy Action Plan. These actions included the following: promoting oversight and accountability, promoting best practices when sharing personal information externally, ongoing general privacy awareness and training, monitor artificial intelligence, awareness on responsibilities as described in the Directives on Privacy Practices developing oversight to ensure privacy requirements are being used effectively, updating the policy on privacy impact assessments, creating an internal directive on monitoring compliance and develop guidance for contracting and procurement.

In alignment with the updated Policy on Privacy Protection and the Directive on Privacy Practices, the ATIP Office initiated a comprehensive privacy compliance exercise throughout the Department. This organization-wide assessment identified areas for improvement and guided actions to ensure compliance with revised requirements.

The CSA also worked to ensure that contracts and agreements involving personal information included appropriate privacy safeguards consistent with the Privacy Act and Treasury Board requirements.

7. Initiatives and Projects to Improve Privacy

The CSA continues to use the ATIP Online Request Service platform managed by the Treasury Board Secretariat to receive requests under the Act.

The ATIP Office currently uses an access to information request management tool which was implemented in 2019-2020. After obtaining this tool, the ATIP Office was able to benefit from its functions which facilitated the production of reports and follow-up of access to information requests. Through TBS procurement, the ATIP Office is preparing for a new system to be implemented in 2026-2027. This new system will allow the ATIP Office to implement technological upgrades and innovations that will improve services (for example, automation of administrative tasks). Throughout the 2025-2026 fiscal year, the ATIP Office worked to complete a data migration exercise from the legacy system to the new software. The data migration exercise was completed, and the new system was fully implemented on March 31st, 2026.

The ATIP Office is also a member of the Access to Information and Privacy Communities Development Office (APCDO) since its inception in 2022-2023. The APCDO is an initiative led by the TBS with membership open to ATIP offices across the federal public service. The goal of the APCDO is to enhance the capacity of ATIP offices to provide Canadians with access to government information in a timely manner by attracting new talent to ATIP offices and providing ATIP professionals with centralized training and professional development programs. In 2025-2026, employees of the CSA's ATIP Office benefited from attending several APCDO training sessions tailored to the community thereby enhancing knowledge and skills.

8. Summary of Key Issues and Actions Taken on Complaints

In 2025-2026, the CSA received 1 complaint which was subsequently abandoned.

Furthermore, no applications or appeals were filed with the Federal Court or Federal Court of Appeal during the reporting period.

9. Material Privacy Breaches

According to the Directive on Privacy Practices, in the event of a material privacy breach, institutions are required to notify the Office of the Privacy Commissioner, the TBS and all parties affected. A material privacy breach has the highest risk impact and is defined as involving sensitive personal information and could reasonably be expected to cause serious injury or harm to the individual and/or involves many affected individuals.

In 2025-2026, the CSA reported 1 material privacy breach relating to Brookfield Global Relocation Services (BGRS) and SIRVA Canada. All CSA affected employees were contacted and offered credit monitoring services. The ATIP Office collaborated with TBS and other Government of Canada departments to support mitigation and coordination efforts related to the breach.

10. Privacy Impact Assessments

All government institutions that create, sponsor or fund programs, projects or initiatives involving the collection, use or sharing of personal information, are responsible for conducting a Privacy Impact Assessment (PIA), in accordance with the Directive on Privacy Practices. In the 2025-2026 reporting period, 1 PIA was completed on the collection of personal information in the coordination of Mission Advisory Groups. A summary of Privacy Impact Assessments can be found at the following link: Privacy Impact Assessments.

11. Public Interest Disclosures

Section 8(2)(m) of the Privacy Act permits the disclosure of personal information without the consent of the individual where the public interest clearly outweighs the invasion of privacy or where it is clearly in the best interests of the individuals. During the 2025–2026 reporting period, no disclosures were made under paragraph 8(2)(m) of the Privacy Act.

12. Monitoring Compliance

The CSA ATIP Office engages regularly with departmental official at various levels to ensure requests are processed in a timely and efficient manner. Meetings are held regularly with CSA sectors and analysts to ensure that timelines are respected. For all requests, legislative deadlines are tracked through an electronic ATIP request processing system and deadlines are followed up on a regular basis. The ATIP Office produces weekly reports to monitor performance within the CSA. The weekly reports are sent to the Vice-Presidents, Chief Information Officer, Communications, ISED and other groups within the CSA who may have interest in the subject matter of the request.

In delivering its mandate, the CSA ATIP Office is involved in many horizontal initiatives and recommendations. The ATIP Office works collaboratively with CSA sectors to ensure that privacy requirements are reflected in contracts, memorandum of understanding and information sharing agreements. The ATIP Office is also focused on the development of tools, guides, and policies to raise awareness, maintain compliance and report on access and privacy processes and procedures.

13. Conclusion

The CSA ATIP Office continues to implement its mandate to respond to all requests for access to personal information in accordance with the Privacy Act.

14. Annex: Delegation Order

Approved in October 2025

Canadian Space Agency