Reports and Publications

ARCHIVED - Internal Audit and Evaluation Reports

Independent Summative Evaluation of the Office of the Privacy commissioner of Canada's Contributions Program
Personal Information Protection and Electronic Documents Act

Final Report

October 30, 2009

Alison Kerry
1270665 Ontario Inc.


Table of Contents

  1. Executive Summary
  2. Acknowledgements
  3. Acronyms
  4. 1. Context
  5. 2. Program Description/Profile
    1. Background
    2. Authority
    3. Objectives
    4. Program Details
    5. Resources
    6. Governance
  6. 3. Approach to the Evaluation
    1. Evaluation Objectives
    2. Evaluation Scope
    3. Evaluation Issues
    4. Evaluation Methodology
  7. 4. Evaluation Findings
    1. Issue #1: Continued Need for Program
    2. Issue #2: Alignment with Government Priorities
    3. Issue #3: Alignment with Federal Roles and Responsibilities
    4. Issue #4: Achievement of Expected Outcomes
    5. Issue #5: Demonstration of Efficiency and Economy
    6. Compliance with New Treasury Board Policy on Transfer Payments
  8. 5. Overall Conclusions
  9. 6. Recommendations
  10. Appendices
    1. Inventory of Materials
    2. Interviews Conducted

Top of Page Table of Contents Executive Summary

This report summarizes the independent summative evaluation conducted on the Office of the Privacy Commissioner of Canada's (OPC) Contributions Program after the first five years of operation. Established under the Personal Information Protection and Electronic Documents Act (PIPEDA), this Contributions Program was established in 2004-2005 to enable the OPC to draw on expertise within institutions and organizations with an interest in privacy protection, to encourage research into a broad range of issues and to support initiatives to raise awareness and promote best practices.

This evaluation concluded the following:

  • There is an ongoing need for the Contributions Program which is responsive to the OPC’s and Canadians’ needs.
  • The Program continues to meet the intent of PIPEDA and to be relevant to the OPC’s mandate and priorities.
  • The OPC is the most appropriate organization for funding this research, as there are no other programs of this kind in Canada. However, greater linkages need to be made with Industry Canada ’s (IC) Contributions Program for Non-profit Consumer and Voluntary Organizations.
  • The Program has funded 41 projects over the first 5 years, allocating over $1.5M, but has spent only 63% of the total contribution funds available. The majority of recipients have been academic institutions (68%), however non-profit privacy/consumer advocacy groups (25%) and industry associations (7%) have also been funded.
  • Projects have helped to increase and enhance information sharing and dissemination of privacy knowledge and best practices, but this has not been quantified and the OPC has not played a significant role in information sharing and dissemination beyond project reports.
  • The appropriate researchers are being targeted by the program, and recent efforts to market the program have been successful; however, greater efforts are required to reach out to the public education and outreach community.
  • The appropriate research projects are being generated; however, few projects are emerging in the priority area of genetic privacy. The new priority on outreach is important to meet the needs of increasing Canadian’s awareness on privacy issues.
  • While project specific results are disseminated by proponents as part of their contribution agreement, project and program-wide results are not being tracked, compiled, reported or promoted by the OPC.
  • While the use and usefulness of project results is not formally assessed or reported, projects are providing useful products and results, such as:
    • Contributions to guidance, policy and legislative decision-making;
    • Contributions to academic research;
    • Best practices that can be used by industry to enhance privacy practices; and
    • Tools that can be used by educators and communities to increase awareness and promote the protection of personal privacy.
  • The Program is in line with, and contributing to, the ultimate outcome of protecting the privacy rights of individuals.
  • The key challenges to the Program include: the lack of internal capacity to effectively manage the program as it grows; and, the lack of performance monitoring and reporting.
  • There are appropriate management, decision-making and oversight processes in place; and, projects funded are aligned to eligibility requirements and noted OPC criteria and priorities.
  • The application review process is internal to OPC and could benefit from more formal linkages with external experts.
  • The Program is seen as cost effective; however, greater administrative efficiencies would be beneficial (e.g., allowing recipients more time to complete their projects in the fiscal year).
  • The Terms and Conditions for the Program need to be revised in line with the new TB Policy on Transfer Payments. [See Section 5 for further details]

The following recommendations are provided for OPC consideration in renewing the Program:

  1. The OPC should draft new Terms and Conditions for the Program, in line with the recommended minor amendments to align with the new Policy on Transfer Payments.
  2. The OPC should consider defining specific priorities for the Contributions Program that are derived from the overall OPC priorities, but are more focussed to direct project submissions, and that change annually to reflect changing privacy trends and needs. In addition, the OPC should consider reserving some funds (e.g., 10%) for projects in areas that are outside the priorities but relate to the overall goal of the program and PIPEDA.
  3. The OPC should consider mechanisms to promote the Program more broadly to the appropriate public education and outreach community.
  4. The OPC should establish an earlier launch date (e.g., Fall) and a more streamlined review, approval and contribution agreement process to ensure projects have a full year for project implementation. As well, the OPC should consider allowing for a small number of 2 year projects, as justified by specific proposals.
  5. The OPC should adjust the application process in the following ways:
    • Move towards an online application process to streamline requirements for applicants, and increase administrative efficiencies.
    • Require proposals to identify in-kind costs being provided and encourage (but not require) other sources of funding to the project.
    • Require successful applicants to report on their performance, in line with the overall performance measurement strategy.
    • The OPC should implement the performance measurement strategy for the Program so that its overall results and impacts are tracked and summarized annually.
    • The OPC should draft an annual report of program accomplishments and results that is provided to Senior Management, OPC's Research, Public Education and Policy Branches, the media, and the privacy community.
    • The OPC should create formal linkages with Industry Canada's Contributions Program for Non-profit Consumer and Voluntary Organizations.
    • The OPC should consider assigning an additional 0.5 to 1 FTE to the administration of the program, under the direction of the Program Manager, to assist with: creating greater efficiencies in the proposal launch/review/negotiation process; promoting the program more broadly; providing more feedback to unsuccessful applicants; linking with IC's Contributions Program; tracking performance; and, annual reporting. [See Section 6 for further details]

Top of Page Table of ContentsAcknowledgements

The evaluator would like to thank François Cadieux, Contributions Program Manager, for providing evidence and assistance in completing this evaluation. Thanks are also provided to all the individuals who provided their insights and input to this evaluation through interviews.


Top of Page Table of ContentsAcronyms

CMC – Certified Management Consultant
G&Cs – Grants and Contributions
IC – Industry Canada
N/A – Not applicable
OPC – Offi ce of the Privacy Commissioner of Canada
PAA – Program Activity Architecture
PIPEDA – Personal Information Protection and Electronic Documents Act
RMAF – Risk Based Management and Accountability Framework
RBAF – Risk Based Audit Framework
SSHRC – Social Sciences and Humanities Research Council
T&Cs – Terms and Conditions
TB – Treasury Board


Top of Page Table of Contents1. Context

This report summarizes the independent summative evaluation conducted on the Office of the Privacy Commissioner of Canada's (OPC) Contributions Program.

Pursuant to the program/legislative authority given the OPC under the Personal Information Protection and Electronic Documents Act (PIPEDA), a Contributions Program was established in 2004–2005 to enable the OPC to draw on expertise within institutions and organizations with an interest in privacy protection, to encourage research into a broad range of issues and to support initiatives to raise awareness and promote best practices.

The terms and conditions for the PIPEDA Class Contribution Program were initially approved on April 13, 2000 by a Treasury Board (TB) decision. The Contribution Program, however, was launched in fiscal year 2004-2005. The OPC was authorized to issue contributions, subject to the Terms and Conditions of the TB submission, for the period extending from April 1, 2005 to March 31, 2010.

As with all Government of Canada Contribution Programs, an evaluation of the performance and ongoing relevance is required after the first five years of operation. This evaluation provides the basis for program renewal, revision or completion. This evaluation follows the direction provided in the Evaluation Plan~~[297]
[22]~~
, completed on March 31, 2009 for the program.

Top of Page Table of Contents2. Program Description/Profile

Background

The Privacy Commissioner of Canada is an Officer of Parliament who reports directly to the House of Commons and the Senate. The Commissioner is an advocate for the privacy rights of Canadians and the powers include:

  • Investigating complaints, conducting audits and pursuing court action under two federal laws;
  • Publicly reporting on the personal information-handling practices of public and private sector organizations;
  • Supporting, undertaking and publishing research into privacy issues; and
  • Promoting public awareness and understanding of privacy issues~~[326][22]~~.

Part of the OPC’s role is implementation of the Personal Information Protection and Electronic Documents Act (PIPEDA). This Act sets out ground rules for how organizations may collect, use or disclose personal information in the course of commercial activities. PIPEDA applies to personal information collected, used or disclosed in the course of commercial activities by all organizations, except in those provinces that have enacted legislation that is deemed to be substantially similar to PIPEDA. PIPEDA continues to apply throughout Canada to federally regulated organizations engaged in commercial activities and to personal information personal information collected, used and disclosed across borders.

In 2004, under PIPEDA, a new Contributions Program with a value of $500,000 annually was initiated by the OPC to support non-profit research on privacy, further privacy policy development, and promote the protection of personal information in Canada.

Authority

The OPC derives its authority to administer the Class Contribution Program from (b) and (d) of PIPEDA:

  • "The Commissioner shall:
  • (b) undertake and publish research that is related to the protection of personal information, including any such research that is requested by the Minister of Industry […]
  • (d) promote, by any means that the Commissioner considers appropriate, the purposes of this part."

Under the Terms and Conditions for the PIPEDA Class Contribution Program, the Commissioner may provide contributions to eligible recipients to encourage research in privacy protection and related issues as well as to support initiatives to raise awareness and promote best practices in information protection.

Objectives

The Program’s objectives are:

  1. To capitalize on existing research capacity in academic, not-for-profit and other sectors to generate new knowledge and support the development of expertise in selected areas of privacy and data protection; and,
  2. To increase awareness and understanding among individuals and organizations of their privacy rights and obligations.
Program Details

The intent and details of the Program have been articulated in the Results-Based Management Accountability Framework (RMAF) and Risk Based Audit Framework (RBAF) drafted in February 2005. Subsequently, the logic model for the program was revised, updated and presented in the Evaluation Plan (March, 2009). This logic model delineates the intended elements or activities and outputs of the program as well as the associated results or outcomes (see following page).

The PIPEDA Class Contributions Program is managed and delivered internally within OPC. The Program operates by setting research priority areas and launching an annual campaign to attract research and public education applicants. Eligible applicants include not-for-profit organizations, including consumer, voluntary and advocacy organizations, education institutions and industry and trade associations.

Proposals are submitted by various applicants, and these proposals are assessed and evaluated by OPC evaluators based on their merit and the degree to which they address the priorities. Successful applicants are awarded a contribution agreement, and funds are released when deliverables are provided. OPC oversees the projects, providing responses as required, and, at completion, evaluates if the final deliverable meets the terms of the agreement, and then provides final payment.

The maximum amount that can be awarded for each research or public education project is $50,000. The maximum any single organization can receive is $100,000. No matching funds are required from applicants. Projects are to be completed within the fiscal year that they are funded. Specific Terms and Conditions are in place to set out the factors that govern this Contributions Program~~[391][22]~~.

Logic model OPC Program
Click on image to enlarge

Resources

The maximum amount available under OPC's Contribution Program is $500,000 per fiscal year. The funding supports between 10–15 contributions per year of approximately $15,000 to $50,000 in value. In the first 5 years, the program allocated over $1.5 million to more than 40 initiatives in Canada.

Funding for 0.25 to 0.50 of a Full Time Equivalent (FTE) position in the OPC to manage the Program is provided from within OPC reference levels. Any additional costs associated with the management of the Program are also covered from within existing OPC reference levels (e.g., the cost of the evaluation) ~~[409][22]~~.

Governance

The Commissioner has prime responsibility for conduct of the work of the Office and for decisions related to the approval of contributions under the Program. The OPC has two Assistant Privacy Commissioners. One is responsible for the Privacy Act and the other for PIPEDA.

The Director, Research, Education and Outreach (REO), which reports to the Assistant Commissioner of PIPEDA, is accountable and responsible for administering the PIPEDA Class Contribution Program ~~[429]

[22]~~ which includes determination of priority areas for research, assessment of applicants and management of contribution agreements. The day–to–day management of the Program is carried out by the Senior Research Analyst in REO. The program is supported by:

  • The Director, Public Education and Communications, in respect to dissemination and communication of information flowing from contribution agreements; and
  • The Director of Financial and Administrative Services, in respect to financial management of the contribution program.

Top of Page Table of Contents3. Approach to the Evaluation

Evaluation Objectives
  1. Determine the ongoing relevance of the program;
  2. Assess the program's performance over its first 5 years; and
  3. Provide recommendations for renewing the program in light of the evaluation's findings and the revised federal Policy on Transfer Payments (October,2008).
Evaluation Scope

The scope of this evaluation included all program activities and outputs from the first 5 years of operations: fiscal years 2004–05, 2005–06, 2006-07, 2007–08 and 2008–09.

Evaluation Issues

As per Treasury Board's Policy and Standards on Evaluation, this summative evaluation assessed the following issues:

Relevance
Issue #1: Continued Need for program Assessment of the extent to which the program continues to address a demonstrable need and is responsive to the needs of Canadians
Issue #2: Alignment with Government Priorities Assessment of the linkages between program objectives and (i) federal government priorities and (ii) OPC's strategic outcomes
Issue #3: Alignment with Federal Roles and Responsibilities Assessment of the role and responsibilities for OPC and the federal government in delivering the program
Performance (effectiveness, efficiency and economy)
Issue #4: Achievement of Expected Outcomes Assessment of progress toward expected outcomes with reference to performance targets and program reach, program design, including the linkage and contribution of outputs to outcomes
Issue #5: Demonstration of Efficiency and Economy Assessment of resource utilization in relation to the production of outputs and progress toward expected outcomes

Based on the program needs and evaluation plan for the OPC's Contributions Program, the following evaluation questions were used to evaluate the Program's performance in the 5 issue areas:

Issue #1: Continued Need for Program

  1. Is there an ongoing need for the program? How is this determined?
  2. Is the program responsive to Canadian's needs? How are priorities set annually?

Issue #2: Alignment with Government Priorities

  1. Does the program continue to meet the Government's intent of the Personal Information Protections and Electronics Documents Act (PIPEDA)?
  2. Does the program continue to be relevant to OPC's mandate and priorities?

Issue #3: Alignment with Federal Roles and Responsibilities

  1. Is the OPC the most appropriate organization for funding this research? Why?
  2. Are there other programs that fund this kind of research in Canada or internationally? How does this program compare?

Issue #4: Achievement of Expected Outcomes

  1. Are the projects helping to increase and enhance information, sharing and dissemination of information, knowledge and best practices?
  2. Are the appropriate applicants being targeted?
  3. Are the appropriate projects being generated?
  4. Are recipients generating useful results?
  5. Are results being shared and disseminated with appropriate target groups?
  6. Are the activities contributing to increased and enhanced public awareness?
  7. Are the projects contributing to increased and enhanced policy development capacity? Is the program helping to enhance the privacy legislation, regulations, policies and practices?
  8. Is the program helping to achieve the ultimate outcome–protecting the privacy rights of individuals?
  9. Has the Program resulted in any unintended impacts (positive or negative)?
  10. What are the key challenges / risks to achieving success? How have these been managed?

Issue #5: Demonstration of Efficiency and Economy

  1. Are there appropriate management and decision–making processes in place to promote efficiency and value for money? Has there been effective oversight of the contribution agreements and funds?
  2. Has the recommend performance monitoring system been implemented?
  3. Have the projects funded been aligned to the eligibility recipients & expenses, evaluation criteria and research priorities?
  4. Is the application review process robust and involving appropriate parties (e.g. OPC sectors, other governments where appropriate)?
  5. Is the program seen as cost effective? Are other options/mechanisms seen as more cost effective?
  6. What would be the impact if no, or less, funding was available from OPC for this research? What would be the impact if more was available?
Evaluation Methodology

The approach to this evaluation was designed to add value to the OPC in its intent to renew the program, and is based on:

  1. Application of a professional methodology, in line with Treasury Board Standards;
  2. Maintenance of a flexible and a collaborative working relationship with the client; and
  3. Provision of independent evaluation services that comply with the Values and Ethics Code for the Public Service and professional standards associated with designation as CMC Code of Professional Conduct.

The following lines of inquiry provided evidence for this evaluation:

  1. Review of program documentation including material on the website (http://www.priv.gc.ca/resource/cp/p_index_e.cfm#contenttop), a file review from OPC’s offices and review of other documents provided by OPC management and/or stakeholders. Key documents included (see Appendix for details):
    • Terms and Conditions
    • Program RMAF/RBAF
    • Program Evaluation Plan
    • Application Instructions
    • Guidelines and evaluation systems for assessing proposals
    • Project Proposals (for 10 selected projects –– about 20% of funded projects)
    • Project Progress and Final Reports (for 10 selected projects)
  2. Interviews with program personnel and external stakeholders (see Appendix for details), including:
    • Senior management (1)
    • Program management (1)
    • Select representatives from 10 funded projects
    • Select representatives from unfunded projects (4)
    • Select representatives in OPC who help evaluate proposals (2)

Evidence collected from the document review and the interviews was analyzed against the evaluation issues and questions, and the results have been documented in this report.

In addition to the standard evaluation, this report also compared how well the Program's existing Terms and Conditions comply with the new TB Policy on Transfer Payments, and what is required to ensure compliance in Program renewal. With this, the OPC can ensure that any revisions to its T&Cs moving forward can address not only evaluation findings but also new policy requirements.

Top of Page Table of Contents4. Evaluation Findings

The findings of the evaluation are presented below according to the evaluation issues and questions:

Issue #1: Continued Need for Program

Is there an ongoing need for the program?

Based on the demand for the program, its specific niche in promoting privacy issues, and universal support from those interviewed (even those who have not been funded), it was found that there is an ongoing need for this program.

This Contributions Program is the only one in Canada that specifically funds privacy related research and outreach. While the Social Sciences and Humanities Research Council (SSHRC) and Industry Canada'sContributions Program for Non-profit Consumer and Voluntary Organizations (see Issue #3 for more details) both can fund some privacy related research, this is not the focus of these funds. Only this program promotes research on specific privacy issues and builds the capacity for privacy related work in a specialized but growing community and in a field that continues to evolve presenting new privacy challenges. All those interviewed indicated the importance of this fund in advancing knowledge and awareness of privacy issues, and encouraging critical independent thinking and debate in the privacy area that is often in the 'background'. The ongoing, consistent nature of this program was also seen as important (rather than sponsoring periodic studies) to maintain the momentum and capacity with those groups specialized in privacy research or advocacy.

Demand for the program has been up and down over the last 5 years. The approximate number of proposals received since the start of the program is displayed below. Demand in the first year of the program was high, and then the number of proposals received dropped significantly until OPC marketing of the program in 2007–08 resulted in high levels of proposals for 2008–09.

The OPC has indicated that they rely on this program to explore emerging privacy issues, contribute new knowledge and reach out to Canadians to help fulfill their role in implementing PIPEDA. The OPC does not have the internal capacity to carry out all these roles itself.

Is the program responsive to Canadian's needs? How are priorities set annually?

The Contributions Program's priorities for the first 5 years are noted below. Only in the last few years have the priorities been formally identified and aligned with the OPC's overall priorities. Priorities from earlier years have been derived from program documentation.

Fiscal Year Priorities
2008–09
  • Research Priorities:
    • national security
    • identity integrity
    • information technology
    • genetic privacy and bio-banking
  • Innovative public education, outreach and awareness raising initiatives
2007–08
  • The protection of personal information on the internet
  • The challenges of secure identification or authentification
  • The intersection of the public and private sectors with regard to the use of personal information
2006–07
  • Surveillance technologies
  • Privacy policies aimed at children
  • The use of DNA in the criminal justice system
2005–06
  • Thriving data brokerage industry
  • The use of DNA samples
  • Workplace surveillance
  • Compliance with and enforcement of the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s private sector privacy law
2004–05
  • Privacy and data protection
  • Fostering an understanding of the social value of privacy
  • Fostering an understanding of the Personal Information Protection and Electronic Documents Act (PIPEDA) in addressing emerging issues

Priorities are currently set for the program through strategic planning for the Office as a whole (not specific to just the contributions program). They are set by the Senior Management Team considering input from industry, privacy advocates, data protection authorities, other government departments, other jurisdictions, and international agencies (OECD, APEC). They are set to be both broad enough to cover the key issues areas (e.g., national security) with specific priorities to target new frontier areas (e.g., biobanking).

Those interviewed indicated that they believe the program is responsive to Canadian’s needs and that the OPC’s priorities for the program are relevant. It was noted that the need for this kind of program is growing with Canadians as privacy issues associated with technology and surveillance are growing in importance and profile, and as the impact on society becomes better known. According to public opinion polls conducted by the OPC, the current priorities most relevant to Canadian’s needs relate to identity integrity and information technology (e.g., fraudulent use of personal information). While Canadians have a low level of awareness of their own privacy rights and the laws that protect them, their main concerns are increasingly centred on the protection of their personal information and their information on–line.

Privacy Scan
A survey of privacy professionals in 2009 (PrivacyScan) indicated that the biggest challenges to privacy professionals relate to: (1) exaggerated privacy threats, in particular transborder flows of personal information to the US; (2) balancing the values of openness and privacy with respect to the internet (and privacy challenges brought about by social networking in particular); and, (3) keeping up with legal development in the privacy field. Based on PrivacyScan results, the OPC may want to consider the following priority areas in the future:
  • Public awareness of privacy threats related to transborder information flows;
  • Privacy challenges around the Internet and social networking; and
  • Enforcement of PIPEDA; and
  • Requirements for privacy legislative revisions/amendments.

To ensure projects funded did in fact meet the stated priorities, this evaluation matched projects to priority areas. While it was difficult to definitely match projects with priorities, all projects funded did fit within the broad priorities established. The overall assessment is that the vast majority of projects relate the top priorities for Canadians – either to the identify integrity or information technology priorities (about 70%) – with a few projects relating more broadly to national security, and fewer still on genetic privacy and public education/outreach (recently added as a priority). The most common themes for projects were around surveillance technologies, on–line practices, or workplace privacy issues (with earlier projects focusing on the understanding of and compliance with PIPEDA). This is not surprising considering the priorities noted from previous years. However, while genetic privacy has been a consistent theme for 4 out of 5 years, there were very few projects funded in this area (assumed due to a lack of number and qualified proposals submitted for this area).

It was noted by a few interviewees that the priorities for the Contributions Program could be different from the overall OPC priorities (derived from, but more focused), to more specifically guide the kind of projects required (i.e., the national security priority is seen as too broad), and also, priorities could change more frequently (i.e., annually) to be more responsive to trends and allow for a wider range of research submissions from year to year. The new priority for public education and outreach was widely supported by stakeholders.

Issue #2: Alignment with Government Priorities

Does the program continue to meet the Government's intent of the Personal Information Protection and Electronic Documents Act (PIPEDA)?

The program does continue to meet the intent in PIPEDA for the OPC to undertake and publish research that is related to the protection of personal information to contribute to the Act's overall goal of protecting personal information in the course of a "commercial activity". The contribution program enables the OPC to draw on organizations with expertise and interest in privacy protection, to research privacy issues and raise awareness around rights and best practices.

This evaluation found that all projects funded related to the intent of PIPEDA. However, it was noted that there is an increasing 'grey line' between public and private privacy issues, and, since the Privacy Act does not have the stipulation to fund research or outreach in the public privacy area, there may have been some projects funded in the national security area that are only loosely related to PIPEDA.

However, the program has overwhelming focused on the commercial sector and, with the new priority to fund outreach projects, the program increasingly meets the intent of PIPEDA.

Does the program continue to be relevant to OPC's mandate and priorities?

The program continues to be relevant to OPC's mandate. The mandate of the Office of the Privacy Commissioner of Canada (OPC) is overseeing compliance with both the Privacy Act, which covers the personal information-handling practices of federal government departments and agencies, and the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's private sector privacy law.

The program's objectives, noted in Section 2, are directly relevant to PIPEDA and the program's priorities are directly aligned with OPC's priorities. The program helps to contribute to the mission of the OPC – to protect and promote the privacy rights of individuals.

Issue #3: Alignment with Federal Roles and Responsibilities

Is the OPC the most appropriate organization for funding this research? Why?

There was consensus that the OPC is the most appropriate organization for this program since it is directly related to their mandate and authorities under PIPEDA. No other organization in Canada has this mandate, and the OPC is seen as both an authoritative and an impartial vehicle for supporting such privacy projects. With this program, the OPC can target small-scale and short-term research and outreach projects in areas that focus on their priorities. This is seen as a specific and appropriate niche.

However, it was noted that OPC could collaborate more closely with other funding agencies (e.g., SSHRC) to encourage more widespread support for privacy research. Such collaborations would also promote OPC's program more broadly to research institutions that would not normally be aware of OPC priorities.

Are there other programs that fund this kind of research in Canada or internationally? How does this program compare?

While there are Provincial Privacy Commissioners/Ombudsmen, none have ongoing programs to fund privacy research and/or outreach (though some support has been provided periodically e.g., in Quebec). The OPC's program was the only noted Canada-wide and privacy–specific funding program, and most interviewees indicated that they would not have been able to undertake their research/outreach project without OPC funding.

Other granting councils fund research that may broadly relate to privacy issues, but these do not specifically target or prioritize privacy research. For example, the Social Sciences and Humanities Research Council (SSHRC) supports university–based research and training in the humanities and social sciences and some researchers that have accessed OPC's funding also get support from SSHRC (e.g., a few projects had co-funding from SSHRC).

Industry Canada’s Contributions Program for Non–profit Consumer and Voluntary Organizations.

The program was established by the Office of Consumer Affairs in order to support such organizations in the production of high quality, independent and timely research on consumer issues. The overall goal is to strengthen the consumer's role in the marketplace through the promotion of sound research and analysis, and by encouraging the financial self-sufficiency of consumer (and voluntary) organizations.

The only other relevant program identified was Industry Canada’s Contributions Program on consumer issues (see text box). This program does fund research into privacy related issues; however this is only a small sample of the overall program projects. They have funded projects in areas such as identity theft, consumer privacy, online consumer protection, and privacy with health information – most of these projects were done by the Public Interest Advocacy Centre. However, this Industry Canada contributions program does not target privacy-related research specifically (and outreach projects are ineligible) – its intent is more around consumer protection and improving the capacity of consumer organizations, and it is limited to the non-profit sector (academics and industry associations are excluded). It is interesting to note that the Consumer Policy Research Database maintained for this program does include project results funded under the OPC’s Contributions Program, as well as OPC related papers/research. While the OPC has informal links and communicates with Industry Canada about their respective programs, no formal processes or structures are in place to ensure the harmonization of efforts and minimize any potential overlap.

Issue #4: Achievement of Expected Outcomes

Overview of Projects and Funding

The OPC’s Contributions Program has funded the following projects over its first 5 years. The projects highlighted in green were chosen for a more in-depth analysis as part of this evaluation:

Organization Project Name Amount
2008–09 —Total of 9 projects with a value of $406,923
Queen's University Camera Surveillance in Canada: Current Trends $50,000
British Columbia Institute of Technology Privacy Protection Checkups:
Promoting Compliance and Providing Education for Business and Nonprofit Organizations
$50,000
Association sur l’accès et la protection de l’information "Warning Personal Information in Circulation!": An Interactive Website and Public Education Tour $48,525
Queen's University Personas : Beyond Identity Protection by Information Control $20,000
University of Alberta Privacy Games: The Vancouver Olympics, Privacy and Surveillance $49,565
Media Awareness Network Kids for Sale: Online Privacy and Marketing $40,833
Memorial University Threats to Mobile Phone Users' Privacy: Who, How and How to Face? $49,000
University of Toronto Privacy and Access to Genetic Research Data $50,000
Crime Prevention Society of Nova Scotia (CPSNS) Trying to Get the Message Out: Identity Theft Awareness $50,000
2007–08 — Total of 6 projects with a value of $258,000
Canadian Internet Policy and Public Interest Clinic (CIPPIC), University of Ottawa
Ottawa, ON
Online Privacy Threats: Trends, Developments and Responses $50,000
Centre for Innovation, Law and Policy (CILP), University of Toronto,
Toronto, ON
Personal Information Protection in the Face of Crime and Terror:
Information Sharing by Private Enterprises for National Security and Law Enforcement Purposes
$50,000
Law Area, Faculty of Business, Ryerson University
Toronto, ON
The Business Risks of Online Social Networks $47,725
Option consommateurs Montréal, QC Managing Personal Information in the Name of the Federal Government:
What do Citizens Know About the Information They Provide to Financial Institutions and to What Degree is the Information Protected?
$43,300
University of Ontario Institute of Technology Oshawa, ON PIPEDA-Compliant Privacy Access Control Model for Protected Health Information $42,550
Department of Computer Science, Memorial University of Newfoundland St. John’s, NL Private/Public Sharing of Personal Information
Lessons from the Health Sector
$22,425
2006–07 — Total of 11 projects with a value of $388,319
Canadian Association for Professional Access and Privacy Administrators and the Canadian Access and Privacy Association
Edmonton, AB and Ottawa, ON
Professional Certifications Standards Project
Research and establish standards for certification of privacy and information access professionals
$50,000
Canadian Internet Policy and Public Interest Clinic Ottawa, ON Digital Rights Management Technologies and Consumer Privacy
A Canadian Market Survey and Privacy Impact Assessment Research use of Digital Rights Management technology in Canada and assess privacyimplications.
$50,000
University of Toronto
Toronto, ON
Visions for Canada: Identity Policy Projections and Policy Alternatives
Examine the various aspects of identity policy in Canada
$50,000
University of Western Ontario London, ON Strategies for Drafting Privacy Policies Kids Can Understand
Research effectiveness of privacy policies aimed at children
$49,059
Children's Hospital of Eastern Ontario Research Institute, Ottawa, ON The Development of Pan-Canadian De-Identification Guidelines for Personal Health Information
Explore the challenges of de-identifying personal health information
$45,000
Memorial University of Newfoundland
St. John’s, NFLD
Technology Choices and Privacy Policy in Health Care
Examine the relationship between technology and policy choices
$44,850
Automobile Consumer Coalition Toronto, ON Vehicle Technology and Consumer Privacy
Explore privacy implications of various surveillance technologies in vehicles
$30,900
Centre for Bioethics, Clinical Research Institute of Montreal, Montreal, QC The Secondary Uses of Health Information and Electronic Medical Records: Current Debates, Policies, Initiatives and Legislation in Canada and Abroad.
Create an inventory of the challenges to privacy posed by electronic health records and databases that contain them
$24,200
L’Union des consommateurs Montréal, QC Do Consumers Benefit From the Trading of Personal Information?
Implications  to Canadians of the personal information trade and analytical study of the effectiveness of Canadian laws in adequately protecting consumers
$22,000
University of Ottawa
Ottawa, ON
Privacy Within the Criminal Justice System: DNA Investigation
Examine the use and handling of DNA collected during the course of investigations
$11,960
Ryerson University
Toronto, ON
Under the Radar? The Employer Perspective on Workplace Privacy Disseminate results of report on workplace privacy, sponsored by last year’s Contributions Program $10,350
2005–06 — Total of 5 projects with a value of $148,850
Canadian Internet Policy and Public Interest Clinic
Ottawa, ON
The PIPEDA: Compliance Testing and Special Report on the Data-Brokerage Industry
Evaluate organizational compliance with PIPEDA and research the growing data-brokerage industry
$50,000
Ryerson University
Toronto, ON
Workplace Privacy - The Employer's Perspective
Highlight some of the issues, concerns and interests that motivate employers in their adaptation of new workplace surveillance technology
$36,150
University of British Columbia Vancouver, BC A Preliminary Exploration of Workplace Privacy Issues in Canada
Explore the challenges to privacy in the workplace posed by current and emerging technologie
$27,000
British Columbia Civil Liberties Association
Vancouver, BC
PIPEDA Enforcement Evaluation Comparing PIPEDA's effectiveness to similar regimes in other jurisdictions $24,200
University of Ottawa
Ottawa, ON
Social Uses of DNA Information in the Context of Developing Policies and Analysis of two DNA related bills Exploration of the social uses of DNA by a comparative analysis of two DNA bills $11,500
2004–05 — Total of 10 projects with a value of $371,590
Canadian Marketing Association
Toronto, Ontario
Taking Privacy to the Next Level
Assess and develop privacy best practices to assist businesses in better handling customer personal information under PIPEDA
$50,000
École nationale d’administration publique Québec, Québec Study on the use of video surveillance cameras in Canada
Perceptions, issues, privacy impact and best practices on the use of video surveillance
$50,000
Queen’s University
Kingston, Ontario
Location Technologies: Mobility, Surveillance and Privacy
Trends and stated and implicit purposes of technology with workers, consumers, travelers and citizens
$49,972
The B.C. Freedom of Information and Privacy Association,
Vancouver, British Columbia
PIPEDA & Identify Theft: Solutions for Protecting Canadians
Gap analysis on weaknesses in personal information management practices that lead to identity theft and policy recommendations for PIPEDA implementation
$49,775
Universities of Alberta and Victoria
Edmonton, Alberta Victoria, British Columbia
Electronic Health Records and PIPEDA Implementation of PIPEDA in the health care sector and application to electronic health records in the primary care setting $49,600
University of Toronto
Toronto, Ontario
A review of Internet privacy statements and on-line practices
Evaluation of implementation of PIPEDA and privacy statements on the Internet by companies in the telecommunications, airline, banking and retail sectors
$48,300
University of Victoria
Victoria, British Columbia
Location-Based Services: An Analysis of Privacy Implications in the Canadian Context
Privacy implications of geographic location-based services — issues raised and major challenges and guidance to encourage compliance
$27,390
Option Consommateurs Montréal, Québec The challenge of consumer identification with new methods of electronic payment Current and new proposed methods of identification of consumers for electronic payment and risk factors $17,100
Simon Fraser University Vancouver, British Columbia Privacy Rights and Prepaid Communications Services: Assessing the Anonymity Question
Justification and feasibility of regulatory measures to eliminate the sale of anonymous prepaid communications services
$14,850
Dalhousie University Halifax, Nova Scotia An Analysis of Legal and Technological Privacy Implications of Radio Frequency Identification Technologies
Study of RFID technology and privacy impact and legal measures to protect privacy
$14,603

In examining how much of the total contribution funds have been spent each year (see below), it is evident that the program has never spent its full allocation.

Year Percentage of total funds spent
2008–09 81
2007–08 52
2006–07 78
2005–06 30
2004–05 74

The total spent over the 5 years being evaluated is $1,573,682 out of maximum of $2,500,000 (or 63%). Therefore, $926,318 has lapsed over the course of the 5 years. Recently, there has been a more concerted effort to promote the program and spend the allocated funds by the OPC.

Most organizations have received close to the $50,000 maximum available and no organization has received over the maximum of $100,000 per year. However, over half of the groups funded have been funded multiple times over the 5 years with total amounts over $100,000. This type of multiple funding may reflect the smallness of the privacy community with the interest and expertise to conduct the work required, and/or may indicate the need to more broadly promote the program beyond the 'privacy experts'.

The majority of recipients have been academic institutions (68%), however non-profit privacy/consumer advocacy groups (25%) and industry associations (7%) have also been funded.

Overview of Outputs and Outcomes of Selected Projects

This evaluation selected 10 funded projects from the past 5 years to examine the range and type of outcomes emerging from the Contributions Program. Key results from these projects are noted below and have been used to inform the evaluation issues and questions related to the achievement of outcomes.

Organisation Project Key Results
2004–05
1. École nationale d'administration publique (ENAP) Québec, Québec; Study on the use of video surveillance cameras in Canada: Perceptions, issues, privacy impact and best practices on the use of video surveillance

$50,000
Outputs:
  • Report identifying socio-political conditions for the introduction and use of video surveillance cameras in cities.
Outcomes:
  • Informed OPC guidelines on use of video surveillance of public places.
  • Sponsored further interest and exploration by the Commission d’accès à l’information du Québec.
2. Canadian Marketing Association Toronto, Ontario Taking Privacy to the Next Level:
Assess and develop privacy best practices to assist businesses in better handling customer personal information under PIPEDA


$50,000
Outputs:
  • Guide for Canadian organizations on privacy models that work.
  • Best Practices in Data Management – Guide for Marketers.
  • Research Findings on Small Business Privacy Compliance.
  • Promoted with CMA’s members.
Outcomes:
  • Assisted organizations in enhancing their implementation of and compliance with PIPEDA by understanding barriers, and providing models and best practices to marketers (noted high volume of downloads of Guides when produced).
2005–06
3. Ryerson University
Toronto, ON
Workplace Privacy – The Employer's Perspective:
The issues, concerns and interests that motivate employers in their adaptation of new workplace surveillance technology


$36,150
Outputs:
  • Report reviewing workplace privacy practices from the perspective of employees.
  • Subsequent research (4) and professional publications (5-10).
  • Numerous public, conference and media appearances (over 50).
Outcomes:
  • Informed academic research.
  • Enhanced public awareness.
  • Input to policy formulation by OPC to incorporate provincial best practices in privacy notification requirements.
2006–07
4. Canadian Internet Policy and Public Interest Clinic
Ottawa, ON
Digital Rights Management Technologies and Consumer Privacy:
A Canadian Market Survey and Privacy Impact Assessment

$50,000
Outputs:
  • Report on digital rights management (DRM) technologies, use in Canadian marketplace and implications for consumer privacy;
  • with key finding that companies often fail to comply with PIPEDA.
  • Presentations at conferences and media coverage.
Outcomes:
  • Enhanced public awareness (Canada and US).
  • Potential contribution to upcoming legislation relevant to DRM and privacy (e.g., anti-spyware legislation and revisions to copyright law).
2007–08
5. Option consommateurs Montréal, QC Managing Personal Information in the Name of the Federal Government:
What citizens know about the information they provide to Financial Institutions and to what degree is it protected

$45,300
Outputs:
  • Provided review of legislative frameworks in Canada and other countries regarding treatment of personal information and analyzed survey on Canadians knowledge of how their financial information is treated.
  • Report on personal information that financial institutions collect and use in the context of the Money Laundering Act.
Outcomes:
  • Helped individuals with a specific case to present a solid complaint against a financial institution either to the OPC or to the Office of Consumer Affairs.
  • Contributed to building stronger cases when Option consummateurs intervenes either before government or industry.
2008-09
6. Queen’s University Kingston, ON Camera Surveillance in Canada:
Current Trends

$50,000
Outputs:
  • Report on camera surveillance in Canada: Part One. Explored rise of camera surveillance, factors behind implementation, meeting regulatory intents and public perceptions.
  • Series of Ottawa Citizen articles with wide media pick-up.
  • Active SCAN web-page with resources, forum, etc.
Outcomes:
  • Built an ongoing network of university researchers from different disciplines (SCAN-Surveillance Cameras Awareness Network) committed to evaluating and analyzing video surveillance in Canada.
  • Improved knowledge on camera surveillance in Canada.
Built an ongoing network of university researchers from different disciplines (SCAN-Surveillance Cameras Awareness Network) committed to evaluating and analyzing video surveillance in Canada.
7. Media Awareness Network (MNet) Ottawa, ON Kids for Sale:
Online Privacy and Marketing

$40,833
Outputs:
  • Kids for Sale workshop and facilitator guide for teachers and librarians– including: powerpoint presentation with speaking notes, workshop guide, handouts, promotional material – for professional development and/or for public education.
  • Media to promote series including: 2 bilingual articles for educational publications, news release to educator via web/listservs, article in MNet media and blog, communications plan for pan Canadian licensing.
Outcomes:
  • Workshop series licensed through provincial/territorial agreements in AB, ON, YK, NT, NWTI, NB, PEI & NFLD; plus additional specific licenses with schools and libraries.
  • Enhance awareness via teachers and librarians. Estimated reach to 9,423 of 15,000 schools in Canada, with 18 of 20 largest school districts; and to library population of 5.6M.
  • Subsequent presentation to US Federal Communications Commission.
8. Crime Prevention Society of Nova Scotia (CPSNS) Nova Scotia Trying to Get the Message Out:
Identity Theft Awareness

$50,000
Outputs:
  • Train the Trainer manual and community information kit on identity theft. 6 modules on: youth, business, "are you a victim", consumers, internet, resource materials; with resources, fact sheets, web links, etc.
  • Train the Trainer session for approximately 103 individuals.
  • Local Newspaper and TV coverage.
Outcomes:
  • Increased public awareness in NS.
    • 31 communities with Identity Theft Trainer resources.
    • 68 agencies throughout NS with resources within their own organizations.
    • 154 communities and 41 businesses provided with information on Identity Theft Awareness.
    • 2,451 individuals provided with information on Identity Theft Awareness.
  • 8 partnerships formed in organizing and delivering this project.
9. University of Alberta
Edmonton, AB
Privacy Games:
The Vancouver Olympics, Privacy and Surveillance

$49,565
Outputs:
  • Report on surveillance efforts for the Olympics and impacts on social privacy.
  • Circulation of report on scholarly websites.
  • Presentation at conference.
  • Excerpts published in US Privacy Journal.
Outcomes:
  • Increased knowledge and researcher awareness
10. British Columbia Institute of Technology Vancouver, BC Privacy Protection Checkups:
Promoting Compliance and Providing Education for Business and Nonprofit Organizations

$50,000
Outputs:
  • Report on privacy protection check-ups performed in Greater Vancouver Area.
  • Very low participation rate by organizations in study.
Outcomes:
  • Recommendations to participating organizations to enhance privacy practices.
  • Recommendations to OPC to develop guidelines, best practices and training tools in areas of personal information security and privacy breach preparedness for small and medium enterprises.

Are the projects helping to increase and enhance information, sharing and dissemination of information, knowledge and best practices?

Based on the projects examined above, there has been increased information, sharing and dissemination of privacy knowledge and best practices. Though the total impact of the Program has not been quantified, it has resulted in best practices in some areas, guides for various audiences to enhance privacy awareness and compliance, and various partnerships to address privacy issues.

The Program did hold one workshop for projects funded from 2004 to 2007 to share research results (25 research studies) that promoted further understanding and awareness of privacy issues between different researchers and research areas. However this has not been repeated and the OPC has not undertaken efforts to further disseminate project results beyond posting of project abstracts on their website. Funded proponents did not see the value in OPC holding future workshops that bring together all funded proponents but rather welcomed the OPC sponsorship of workshops on specific issue areas. In addition, interviewees indicated that a press release or summary of research results circulated to the privacy community could be helpful in enhancing information sharing and building on results.

The OPC relies on the project proponents themselves to disseminate their results, and each project has done this in various ways (media, newsletter, websites, scholarly articles, presentations, etc.). Most interviewees indicated that they are aware of the results from other OPC funded projects, but this mainly involves proponents reviewing findings only in their particular area of interest or determining what else has been funded to help shape their future proposals.

Are the appropriate researchers being targeted?

The Program is promoted through the formal annual launch where a press release is provided to solicit proposals. In recent years, the OPC has also marketed the program in the following ways to target the appropriate applicants:

  • Use of Privacy Scan to advertise the launch of the Program. Privacy Scan is the longest standing publication of its sort in Canada. It is known within the industry as the definitive source of timely news and analysis, and reaches privacy professionals who work in this area (no distribution figures available).
  • Use of the Canadian Association of University Research Administrators network to advertise the launch of the Program. This network reaches about 600 people and targets university researchers who are looking for Contributions for their research. Many interviewees noted that this was how they learned about the program and so it seems to be one of the most successful ways of targeting the university/research audience.
  • Use of "Association des université de la francophonie canadienne (AUFC)" to advertise the Program to 30–40 francophone universities outside Québec.
  • Use of a distribution list of former recipient’s (about 30 recipients, updated annually).
  • Use of Industry Canada's Office of Consumer Affairs newsletter to advertise the program, reaching about 400 consumer groups across Canada.
  • Use of a shared listserv to notify the OPC’s network of provincial colleagues.

Most interviewees knew about the Program through their university administrators and/or through their general knowledge of the OPC and privacy research in Canada. A few were reached via the Provincial Privacy Offices or via IC's Consumer Affairs newsletter. The Contributions program is well known in the privacy research community but is not as well known in the public education and outreach community involved with privacy related issues (those proponents heard about the Program through more opportunistic and ad hoc ways). The OPC may want to consider reaching out further to these groups through provincial channels and/or through crime prevention, educational or industry associations.

Are the appropriate research projects being generated?

As noted under Issue #1 and #2, the research projects being generated are in-line with the noted OPC priorities and are of relevance to both the OPC's needs and the needs of Canadians. Generally the research projects were viewed as high quality and successful, engaging prominent experts in the field and also reaching out to new organizations to fund a range of project areas. However, there are few projects emerging in the area of genetic privacy, a noted priority. The new priority on outreach was seen as important and should generate more projects in the future to meet the needs of increasing Canadian's awareness on privacy issues.

Are recipients generating useful research results?

The 'usefulness' of the results is not formally assessed by the OPC. Rather, each project's final deliverable is assessed to ensure it meets the requirements set out in the contribution agreement before final payment is provided. However, based on the projects selected for evaluation, it is evident that a number of the projects are providing useful products, for example:

  • Contributions to guidance, policy and legislative decision-making;
  • Contributions to academic research;
  • Best practices that can be used by industry to enhance privacy practices; and
  • Tools that can be used by educators and communities to promote the protection of personal privacy.

The degree to which these products are used, however, it not tracked (see some examples below).

Are results being shared and disseminated with appropriate target groups?

The output from each funded project is a final research report or, in the case of outreach projects, the outreach tools and report. Results are generally shared by the following means:

  • Publication of an abstract on the OPC website (with links to final report maintained by the applicant)
  • Presentations at academic conferences
  • Publication of research results in academic literature
  • Media coverage of results/issues
  • Promotion via listservs and web pages

As mentioned previously, the OPC does not further disseminate the results of projects to target groups. No statistics are compiled for the program either on the web hits to the OPC research pages or on the reach achieved by project proponents overall (however individual project statistics are included in a number of specific project files).

Are the activities contributing to increased and enhanced public awareness?

While there are no overall figures to track the increase in public awareness, virtually all projects contributed to increased and/or enhanced awareness of privacy issues in some manner. While not 'outreach' projects per se, many projects have had 'outreach' components (e.g., providing guides to businesses, disseminating results to employers, etc.). Some of this is specific to certain audiences (academics, marketers, teachers). Only in 2008–09 has there been a priority on funding outreach projects that aim to enhance general public awareness. Recent projects have involved, for example, web workshops for teachers on children and internet issues, and, regional training sessions on identity theft. Public opinion polls conducted for the OPC indicate the need to conduct further education and outreach activities as Canadians generally have a low level of knowledge of privacy issues.

Are the research projects contributing to increased and enhanced policy development capacity? Is the program helping to enhance the privacy legislation, regulations, policies and practices?

In some cases, projects have contributed to policy development. For example,

  • Video surveillance research informed OPC’s guidelines on the use of video surveillance of public places.
  • Workplace privacy research provided input to policy formulation by the OPC to incorporate provincial best practices in privacy notification requirements.
  • Research on electronic health records contributed to policy discussions at the federal and provincial levels.
  • Digital rights management (DRM) research has the potential to contribute to upcoming legislation relevant to DRM and privacy (e.g., anti-spyware legislation and revisions to copyright law).

However, this not measured on a Program wide-basis by the OPC.

Is the program helping to achieve the ultimate outcome – protecting the privacy rights of individuals? How? What improvements in privacy have been generated?

While it is not possible to directly measure contributions to this outcome, the program’s results are in line with the aim of protecting the privacy rights of individuals and it has contributed to this through increased awareness of individual rights and contributing to the policy development process to allow the OPC to protect Canadians’ privacy rights (as noted above). In addition, funding of advocacy groups has enabled them to better advocate for privacy rights (e.g., participate in CRTC proceedings to advance privacy issues, assist in individual cases of privacy protection with financial institutions). As well, best practices developed for industry aims to improve their practices in protecting privacy rights.

All interviewees believed that the Program was having a positive impact in protecting the privacy rights of individuals.

Has the Program resulted in any unintended impacts (positive or negative)?

The only unintended impact noted was that the Program helps to build the capacity of privacy non-profit groups. This was not an articulated objective of the program, and is not done consistently or intentionally, but was acknowledged as a benefit by those advocacy groups interviewed.

What are the key challenges / risks to achieving success?

Most of the key risks noted in the Risk Based Accountability Framework (RBAF) for the program have been adequately managed by the program. These risks include:

  • Funding Risk: That the GOC will not fund OPC with adequate resources to meet its results commitments.
  • Political Risk: That recipient reports will be critical of government privacy policy or of actions taken or not taken.
  • Capability Risk: That there will not be a reasonable pool of applicants from which to select reputable and quality recipients.
  • Completion of research risk: That entities provided with funding and individual researchers assigned to projects by these entities will not remain stable.

While no new risks were identified, two original risk areas remain as challenges for the Program:

  • Program delivery risk: That sufficient capability will not exist in OPC to manage the program.
    • As the number of proposals submitted to the Program continues to increase, it may overwhelm the capacity of the OPC to manage effectively and may lead to dissatisfaction with a larger number of applicants who are unsuccessful.
  • Data collection risk: That recipients will not be able to provide data necessary to measure program results.
    • Recipients have provided some data on their program outputs, reach and results, but these have not been consistently provided and/or provided in a manner that facilitates performance measurement and reporting at the Program level by the OPC.
Issue #5: Demonstration of Efficiency and Economy

Are there appropriate management and decision-making processes in place to promote efficiency and value for money? Has there been effective oversight of the contribution agreements and funds?

The Program is managed internally in OPC by a Senior Research Manager (which takes about 0.25 to 0.5 FTE per year). Key roles include management of the initial call for proposals and the process for evaluating proposals, and dealing directly with recipients throughout the fiscal year, as required, to ensure the contribution agreements are followed or adapted appropriately. Interim payments are tracked appropriately. Final deliverables are reviewed to determine if they are providing value for money (compared to what was stated in the agreement) and, based on this review, a final payment is made.

Financial and administrative processes are appropriate for the low level of program risk involved (as noted in the RBAF). While the amount of oversight on each project is relatively low (quarterly reports not always required ~~[1996][22]~~, interim deliverables not required), this is appropriate for the small value of the contributions and the short time frame. As well, the project proponents are usually well established professionals with a successful track record, requiring little oversight. Of the more than 40 projects funded, the Program has only had to go back to one proponent after reviewing the final deliverable. Project recipients interviewed all indicated that there was an appropriate level of oversight of their contribution agreements, that the OPC Program Manager was responsive, respectful and helpful.

Program reports are made to the senior management team at two times during the year: (1) when proposals are recommended for funding; and (2) when final payments are made. There is no formal external reporting at the proposal review/selection stage to other departments (like IC) who may fund similar projects.

Has the recommend performance monitoring system been implemented?

The RMAF/RBAF developed for this program as part of the Terms and Conditions recommended the following performance measurement strategy and reporting strategy:

Suggested Performance Measurement Strategy for OPC’s Contributions Program:

Element Performance indicators Data Source & Collection Method Responsibility for collection Timing / Frequency
Outputs
Reports
  • # reports
  • dissemination of reports
  • project reports
  • follow up requests to recipients
  • recipients
  • annual
Workshops, Conferences
  • # events
  • # of participants
  • range of participants
  • workshop reports
  • project reports
  • follow up requests to recipients
  • recipients
  • annual
Academic papers
  • # papers
  • quality of papers
  • dissemination of papers
  • project reports
  • follow up requests to recipients
  • recipients
  • annual
Recommendations
  • # of recommendations
  • quality of recommendations
  • range of recommendations
  • project reports
  • follow up requests to recipients
  • recipients
  • annual
Short term Outcomes
Increased information
  • publication of information by recipients
  • follow up requests to recipients
  • web sites
  • reports
  • provincial
  • commissioners
  • recipients
  • OPC staff
  • annual
Increased awareness
  • changes in audience awareness
  • surveys
  • contribution projects
  • OPC staff
  • Biennial
Suggestions for resolving issues
  • # suggestions
  • range of suggestions
  • quality of suggestions
  • recipient
  • reports
  • follow up requests to recipients
  • recipients
  • OPC
  • annual
Identification of legislative or policy changes
  • # suggestions
  • range of suggestions
  • quality of suggestions
  • recipient
  • reports
  • follow up requests to recipients
  • recipients
  • OPC
  • annual

Suggested Reporting Strategy for OPC’s Contributions Program:

Internal Reporting External Reporting
1. At the time of recommending a series of contribution agreements, the Commissioner will be provided with a summary of the nature of proposals received, the quality of the proposals received, the innovation represented in the proposals and an assessment of the merits of the recommended contributions. 2. Information from the reports received from recipients will be summarized and reported in the OPC Annual Report.
3. On an annual basis, an assessment report will be prepared analyzing the results obtained from the contributions provided in the past fiscal year (both successes and if any failures), the extent of achievement of outcomes (as identified in the Logic Model), and lessons learned from the completed contribution agreements. 4. The OPC web site will be used to provide information on who has been selected for contributions, that nature of the research to be conducted and a summary of the resulting reports
5. The OPC may publish the reports received on its web site or may link to locations where recipients have published the reports.
Audit Requirements for IC’s Contributions Program Non-profit Consumer and Voluntary Organizations:
For organizations receiving $100,000 or more in project contributions in any given year, audits will be required for each of the projects funded under the Program in that fiscal year. For organizations receiving less than $100,000 but more than $40,000 in project contributions in any given year, an audit may, at the discretion of the Director General of the Office of Consumer Affairs, be required for each of the projects funded under the Program in that fiscal year. For organizations receiving $40,000 or less in project contributions in any given year, audits will not be required for the projects funded under the Program

The recommended performance measurement strategy has not been implemented and there is no annual assessment report on the performance of the program. The Program only provides a summary of project reports and annual spending to management, and the project report summaries are provided on the OPC web site with links to the full report.

There has been no auditing of the Program (the RBAF recommended an audit of the contribution program at the same time as an audit of Research and Policy functions in the OPC, which was not planned and the OPC audit function has only been newly established)~~[2357][22]~~. In addition, the RBAF recommended that recipient audits would only occur should OPC staff suspect some form of wrongdoing or misuse of contribution funding – this is consistent with other similar programs (see text box). No recipient audits have been conducted.

Have the projects funded been aligned to the eligibility recipients & expenses, evaluation criteria and research priorities?

There is a formal review and assessment process in OPC to determine which proposals should be funded before potential recipients are recommended to the Commissioner, who approves the final selection of recipients.

The formal proposal assessment process includes an initial review by the Program Manager to ensure applications are eligible. OPC also has a Basic Eligibility Checklist to ensure that all selected projects meet the eligibility requirements of the Program’s Terms and Conditions, specifically the eligibility of applicants, activities and expenses.

Following the eligibility check, the proposal is provided to an internal 'expert' evaluator. This evaluator assesses the proposed project for:

  • Relevance (both to OPC’s mandate and to the Program’s priorities) and importance;
  • Validity and feasibility of methodology, team capability and cost;
  • Usefulness of results to OPC, and/or interest to OPC audiences and stakeholders;
  • Effectiveness of the plan to promote/communicate the results; and
  • Overlap with other applicants and proposals.

A second evaluator also reviews and comments on the proposal assessment made by the first evaluator. Then there is an overall scoring chart that compiles funding applications by score, issue addressed, and region. Decisions are made not just on overall score but also to have a balance in the priority issue addressed and regional representation across the country. Some interviewees indicated that the 'best' projects may not always be funded due to the need to ensure representativeness.

If projects are unsuccessful, they are provided with a standard rejection letter and no details are provided on why they were unsuccessful (such details would be welcomed by applicants so they can improve future submissions). However, if applicants contacted the OPC directly, they were provided with further and useful input as to why their proposals were rejected.

Is the application review process robust and involving appropriate parties (e.g. OPC sectors, other governments where appropriate)?

As noted above, the application review process involves only experts and managers within OPC (including various sectors). No external review is involved. In some cases, it may be appropriate to have other government departments (e.g., Industry Canada) involved in proposal review to ensure there is no duplication in funding and to learn from the track record of organizations that may have been funded by others. This is particularly relevant as the program moves towards funding more public education and outreach with groups that are not as familiar as the universities and privacy advocacy groups with which OPC works.

Is the program seen as cost effective? Are other options/mechanisms seen as more cost effective?

The Program is widely seen as cost effective by management and applicants alike. The evaluation assessed that cost effectiveness is attained through the following means:

  • Extensive use of graduate students in research projects under the supervision of expert privacy researchers;
  • Extensive use of volunteers and/or students for outreach projects;
  • Small amount of funds provided, and short time frame, for the results received (these provide incentives for innovative and efficient approaches);
  • Providing funding that results in further research, collaboration and capacity beyond the project; and
  • Minimizing program administration costs (Note: OPC spends about 0.25 to 0.5 FTE per year while IC’s program has 2 administrators plus a policy outreach person to promote the program and publicize results – while value of the IC fund is higher ($1.6M/year) both funds manage about the same number of projects per year).

The program does not require matching funds, but does get in–kind costs provided with all applications (e.g., office space, administrative time, some salary, etc.). In a few cases, there are other sources of funds involved in projects (e.g., SSHRC). Most interviewees noted that if matching funds were required, it would impair their ability to be engaged with the program.

While all interviewees indicated that they believe the OPC is the most appropriate organization for funding this research, alternatives to this program could include of the following options, with the implications noted:

Alternatives Implications
Building the capacity of the OPC’s internal research and communications groups
  • Would be more expensive than providing contributions, but would be under direct control of OPC and may link more directly to policy development.
  • Would not stimulate external research and critical thinking on privacy issues by academics.
  • Would not allow OPC to build on privacy expertise and reach/networks in the academic, industry and non-profit sectors – could not offer the breadth and depth of research or outreach available externally.
  • Would not develop external capacity on privacy issues.
Contracting out specific research and outreach projects
  • Would be more expensive than providing contributions, but would offer more control and direction from OPC.
  • Would not stimulate research and critical thinking on new privacy issues by academics.
Delivery of Contributions Program through a non–profit group
  • Would be much more expensive than providing contributions, as capacity would need to be built, overhead funded, etc.
  • Would provide independence and arms length from OPC, but result in less OPC control in terms of directing research and outreach priorities.
  • Would reduce administrative burden in OPC.

In terms of cost effectiveness of the program administration and application process, all interviewees believed that the proposal submission and review process was appropriate for the funding amounts available, clear and not overly burdensome.

In terms of cost effectiveness of the program administration and application process, all interviewees believed that the proposal submission and review process was appropriate for the funding amounts available, clear and not overly burdensome.

OPC Contribution Program Launch Dates
  • Year 1 (04–05): June 1, 2004
  • Year 2 (05–06): July 6, 2005
  • Year 3 (06–07): March 22, 2006
  • Year 4 (07–08): January 12, 2007
  • Year 5 (08–09): January 25, 2008
  • Year 6 (09–10): December 1, 2008

The largest complaint on the Contributions Program was that a full fiscal year was not provided to conduct the project. By the time the proposals are reviewed and the contribution agreements are negotiated, many projects don’t start until the summer leaving only about 8 months to complete project activities. This was seen as much too short a time particularly for research projects that often take multiple years to adequately complete (university administrative processes, field studies, training, ethics review, etc. all take time as part of research studies). This short time frame also does not leave sufficient time for the effective dissemination of research results. An earlier application date and more efficient review and approval process are desired. [Note that launch dates for the program have been earlier in recent years (see text box)]. In addition, consideration could be given to providing 2 year funding in some cases, where justified, as is provided by the IC Contributions Program.

What would be the impact if no, or less, funding was available from OPC for this research? What would be the impact if more was available?

When interviewed, most applicants indicated that their projects would not have been undertaken without the funding from the OPC. There are few other sources of funds for privacy related research and outreach, and the opportunities presented by this Program encourage them to develop proposals that are specific to privacy and to the priorities articulated by the OPC.

In addition, applicants indicated that the $50,000 amount available per project seemed to be about the right amount of funds for a one year project. Some indicated that they would prefer smaller contributions if more projects could be funded, while others favoured larger and longer projects – i.e., $100,000 for a 2 year timeframe. If more funds were available, and more time, proponents indicated they would be able to conduct more in-depth projects and better disseminate and promote the results.

Compliance with New Treasury Board Policy on Transfer Payments

Overview

In October 2008, Treasury Board approved a new Policy on Transfer Payments. The objective of the new Policy is to ensure that transfer payment programs are managed with integrity, transparency and accountability in a manner that is sensitive to risks; are citizen–and recipient-focused; and, are designed and delivered to address government priorities in achieving results for Canadians. This policy will apply to all new and renewed contributions programs approved after March 31, 2010. Therefore, the Terms and Conditions for the OPC's Contributions Program, which need to be renewed following March 2010, need to be in compliance with this new policy.

Some of the key changes in the new Policy include:

  • Clarified roles and responsibilities for Treasury Board, Ministers, the Secretary of the Treasury Board, and Deputy Heads.
  • Emphasis on a risk based approach to monitoring and recipient reporting.
  • A requirement to engage recipients, when appropriate.
  • The requirement to establish departmental service standards.
  • Requirements to pursue harmonization of transfer payment programs and standardization of administrative practices.
  • A leadership and support role for the Secretary of the Treasury Board to promote and facilitate collaboration among departments.
  • Increased authority for Ministers to approve continuation of terms and conditions following a review of the relevance and effectiveness of a transfer payment program.
  • Ministers will be able, under certain conditions, to seek delegation from Treasury Board to approve the amendments of terms and conditions for some or all existing departmental transfer payment programs.

Terms and Conditions Requirements

As part of this evaluation, the existing Terms and Conditions for the OPC's Contribution Program were assessed against the requirements of the new Policy, with the details provided below.

The Directive on Transfer Paymentsprovides detailed, mandatory requirements on the design, delivery and management of transfer payment programs under the Policy on Transfer Payments. There are 4 key requirements related to Terms and Conditions (T&Cs).

  1. Core elements for new or redesigned transfer payment programs should be assessed and documented before the development of Treasury Board submissions and terms and conditions for transfer payment programs [see assessment below].
  2. No transfer payment is made before the terms and conditions for the transfer payment program have been approved. Terms and conditions may not need to be approved by Treasury Board if the transfer payment is to be made pursuant to a statute or a statutory instrument, or when the recipient has been named in the Estimates or in a statute [in place]
  3. Terms and conditions for contributions should address a number of identified elements [see assessment below].
  4. Potential recipients should have ready access to information about transfer payment programs and a description of the program should be made public, including application and eligibility requirements and the criteria against which applications will be assessed [in place – on OPC website].

Note - There are also requirements that OPC should be familiar with related to: determination of funding level; funding agreements with recipients; cash management; recipient reporting, monitoring and auditing; up-front multi–year funding; monitoring and reporting requirements. These are detailed in the Directive on Transfer Payments and are not included here as they don't relate specifically to the T&Cs.

Assessment of the OPC's T&Cs and Changes Required

Based on the requirements noted above, the following table provides the assessment of how well the existing T&Cs for the OPC Contributions Program meet the requirements~~[2575]

[22]~~. The changes needed in the new OPC's T&Cs, to ensure compliance with the policy, are noted in the last column.

Element of T&Cs Assessment Changes Required
Mandatory elements – T&C must include:
1. The specific legal and policy authorities for the transfer payment program and, where applicable, any legislative requirement to seek approval from the Governor in Council through an Order in Council Authority included.  
2. The purpose, objectives and expected outcomes, with clear linkages to the departmental and government objectives, department's Program Activity Architecture and related strategic outcomes. Objectives and outcomes are provided and linked to OPC mandate. Need to make direct links to OPC’s PAA and strategic outcome.
3. When applicable, the manner in which the redesign of the transfer payment program addresses the results of an evaluation or review of relevancy and effectiveness. Evaluation conducted October 2009. Need to adjust to reflect evaluation recommendations.
4. The feasibility of harmonizing (aligning or integrating) the program being created or redesigned, with other transfer payment programs within the department and, to the extent possible, with other departments. No other related transfer payment programs in OPC, however Industry Canada’s Contributions Program for Non-profit Consumer and Voluntary Organizations does fund some similar projects (e.g., Privacy research by Consumer Groups). Establish formal linkages and processes with IC’s Contributions Program to share information on proposals and results to minimize overlap and maximize impact.
5. Whether a horizontal transfer payment program involving other departments is required and, if so, whether legislative and spending authorities are appropriate and whether umbrella terms and conditions or complementary terms and conditions should be prepared. N/A – while there is some overlap with IC’s Contributions Program, they have different goals and eligible recipients.  
6. The identification of eligible recipients or category of recipients, the nature and type of initiatives that will be considered eligible under the transfer payment program. Eligible recipients are identified. The nature and type of initiatives eligible is not specified in the T&Cs (specific outputs noted). Specify nature and type of initiatives or projects that are considered eligible.
7. The maximum amount payable to any recipient annually or in total, or the maximum payable with respect of any initiative or project, as applicable; and, the method to be used to determine the amount a recipient will be eligible to receive under the transfer payment program. Maximum amount noted, but not clear whether annual or total, and method used to determine amount not included (minimum level noted). Identify maximum amounts annually and in total, and the method to be used to determine the amount of a contribution.
8.Expenditures that are considered eligible expenditures in determining the amount of a contribution. Eligible expenditures may be described either generally as those expenditures necessary to support the purpose of the funding or specifically in terms of the type and nature of expenditures that are to be funded. Type and nature of eligible expenditures included.  
9.A plan for the engagement of potential recipients and other interested parties, where deemed appropriate. Not included. OPC should document how it engages potential recipients.
10. An identification of expected results with performance measures and indicators for monitoring and reporting; performance measurement strategy for ongoing performance management of the transfer payment program, including the performance measures and indicators and the supporting data requirements and data collection strategy. RMAF included. Update RMAF in line with renewed program.
11. The risks specific to the transfer payment program, the potential risks associated with applicants and recipients, and the measures that will be used to manage these risks. RBAF included. Update RBAF in line with renewed program.
12. The rationale used in the selection of the appropriate transfer payment instruments taking into account the characteristics of the various instruments relative to the public policy issue to be addressed, the specific program objective or outcome, the level of funding, the type of recipients, and the nature and level of risks. In particular the following should be considered: –– ––
  • Grants are appropriate when the amount of funding to be provided can be determined in advance and eligibility criteria and information obtained before payment provide assurance that the grant will be used for the purpose for which it is provided. Grants are not appropriate where funding provided to a recipient is to be further distributed to one or more persons or entities.
N/A  
  • Contributions are appropriate when the department deems it necessary to monitor progress and results, receive an accounting of the use of funds from the recipient, and have the right to carry out a recipient audit or to request some other type of certification or audit assurance from the recipient.
Applicable as multiple recipients are involved each year, based on competitive review process; results/products are discrete annual deliverables and are required to inform OPC activities. Amount of funding cannot be determined in advance, as it is dependent on specific proposals submitted.  
  • A transfer payment that provides up-front multi-year funding is usually only appropriate where the demonstrated financial stability of the recipient is a necessary condition for the recipient to meet objectives involving the implementation of longer-term plans, undertaking multi-year commitments or matching leveraged funding from the public and private sectors.
N/A  
  • Endowment funding may be appropriate when there is an intention or requirement to fund a recipient on a long-term basis and the recipient has the capacity to manage invested funds. When endowment funding is appropriate, the selection of the transfer payment instrument to make the payment is important. A grant may be most appropriate where sufficient assurance is available at the time of providing the endowment that the funding will be used for the purposes for which it is provided and where no accounting for the use of the funding is deemed necessary. Where ongoing monitoring and reporting on the use of the funds provided is required, endowment funding should be provided on the same basis as other up–front multi-year funding.
N/A  
13. The opportunity to use the additional contribution funding approaches for transfer payments to Aboriginal recipients, as described in Appendix K: Transfer Payments to Aboriginal Recipients. N/A  
14. Where the transfer payment program provides for contributions that are wholly or partially repayable, the conditions that determine the amount and timing of repayment. N/A. No repayable contributions – the contribution is made with the primary aim of furthering basic research; and, the contribution is less than $100,000, and the administrative burden of repayable contributions is not justified.  
15. The administrative requirements on applicants and recipients and a strategy to ensure these are no more than is needed to meet the department's control, transparency and accountability requirements. The evaluation found that administrative requirements are at the appropriate level.  
16. Where contributions are to be used, the basis on which contribution final payments and any progress payments are to be made, which is to be one or a combination of the following:  
  • achievement of pre–determined performance expectations or milestones;
Final payment is made following the submission of a final report and review by the OPC that the deliverable is consistent with project proposal.  
  • eimbursement of eligible expenditures;
Payment is made following the submission of a financial report on the use of the funding, reimbursing any funds in excess.  
  • a costing formula; or
N/A  
  • a predetermined annual amount when the fixed and block contribution funding approaches for transfer payments to Aboriginal recipients are used. This may also be applicable when the flexible contribution approach for transfer payments to Aboriginal recipients is used.
N/A  
The choice of approach should reflect the risk associated with the transfer payment program and the known capacities of the recipients. The program is relatively small, straightforward and uncomplicated (in dollar value, in number of recipients and in scope). Approach based on risk matrix in the RBAF, where probability that recipients will not have capacities to complete research ranked as low. The evaluation found that the approach was appropriate for the risks encountered over the first 5 years (low risk).  
17. The basis for a stacking limit, in accordance with Appendix C: Total Canadian Government Funding and Stacking Limits. Stacking limits included.  
18. A description of the information required in a request for funding from an applicant and the criteria that will be used to assess funding applications. Supporting material for applications for assistance included. Criteria used to assess applications not explicit. Add section noting the criteria that will be used to assess funding applications.
19. A general description of the information that will be requested from recipients in financial and performance reporting, including information on results achieved to support the program's performance measurement strategy and departmental reporting. Basis and timing of payment included, noting requirements for a report on findings and results, and a report on use of contribution funding. Need to be more explicit on performance reporting required by recipients (to contribute to RMAF performance measurement strategy).
20. The feasibility of standardizing the processes, systems and procedures to be used in delivering the transfer payment program being designed or redesigned with those that support existing transfer payment programs within the department and, to the extent possible, with those of other departments. N/A.  
21. The feasibility of using applicant and recipient information already available to departments to facilitate access to the transfer payment program and reduce the administrative requirements imposed on recipients, while respecting all federal legislative requirements, including the Privacy Act. Not included. Need to move toward on-line application process that included applicant and recipient information already available.
22.The implications for the transfer payment program of obligations undertaken by Canada as a signatory to international multilateral agreements aimed at preventing inappropriate trade barriers, and a demonstration that these obligations have been respected. N/A.  
23. The sustainable development implications of the transfer payment program. N/A.  
24. Whether a payment under the proposed transfer payment program would trigger any obligation under the Canadian Environmental Assessment Act. N/A.  
25. Whether there is a need to establish any rights to the use of intellectual property (IP) created by recipients through their use of transfer payments and, if so, the basis for establishing such rights. Not included. Need to add IP rights section, noting the basis for establishing rights to the use of intellectual property created by recipients through their use of contributions.
26. Where goods, services or assets are to be transferred under a transfer payment program, the spending authority for such transfers based on specific vote wording in an appropriation act. N/A.  
27. The manner in which the obligations of the Government of Canada set out in the Official Languages Act are to be taken into account and, where relevant, applied in designing the transfer payment program. Not included Need to add an Official Languages requirements section, noting: (1) a description of how the transfer payment program will respect the obligations of the Government of Canada set out in Part VII of the Official Languages Act; and (2) a description of how the services or benefits will be made available in both official languages in accordance with the Official Languages Act.
28. The number of years over which the terms and conditions for the transfer payment program will apply. Included Need to update with new timeframe.

Top of Page Table of Contents5. Overall Conclusions

This evaluation concluded the following, in line with the evaluation issues and questions;

  1. There is an ongoing need for the Contributions Program which is responsive to the OPC’s and Canadians’ needs.
  2. The Program continues to meet the intent of PIPEDA and to be relevant to the OPC’s mandate and priorities.
  3. The OPC is the most appropriate organization for funding this research, as there are no other programs of this kind in Canada. However, greater linkages need to be made with Industry Canada’s (IC) Contributions Program for Non-profit Consumer and Voluntary Organizations.
  4. The Program has funded 41 projects over the first 5 years, allocating over $1.5M, but has spent only 63% of the total contribution funds available. The majority of recipients have been academic institutions (68%), however non-profit privacy/consumer advocacy groups (25%) and industry associations (7%) have also been funded.
  5. Projects have helped to increase and enhance information sharing and dissemination of privacy knowledge and best practices, but this has not been quantified and the OPC has not played a significant role in information sharing and dissemination beyond project reports.
  6. The appropriate researchers are being targeted by the program, and recent efforts to market the program have been successful; however, greater efforts are required to reach out to the public education and outreach community.
  7. The appropriate research projects are being generated; however, few projects are emerging in the priority area of genetic privacy. The new priority on outreach is important to meet the needs of increasing Canadian’s awareness on privacy issues.
  8. While project specific results are disseminated by proponents as part of their contribution agreement, project and program-wide results are not being tracked, compiled, reported or promoted by the OPC.
  9. While the use and usefulness of project results is not formally assessed or reported, projects are providing useful products and results, such as:
    • Contributions to guidance, policy and legislative decision-making;
    • Contributions to academic research;
    • Best practices that can be used by industry to enhance privacy practices; and
    • Tools that can be used by educators and communities to increase awareness and promote the protection of personal privacy.
  10. The Program is in line with, and contributing to, the ultimate outcome of protecting the privacy rights of individuals.
  11. The key challenges to the Program include: the lack of internal capacity to effectively manage the program as it grows; and, the lack of performance monitoring and reporting on the Program.
  12. There are appropriate management, decision-making and oversight processes in place; and, projects funded are aligned to eligibility requirements and noted OPC criteria and priorities.
  13. The application review process is internal to OPC and could benefit from more formal linkages with external experts (e.g., IC’s Contributions program).
  14. The Program is seen as cost effective; however, greater administrative efficiencies would be beneficial (e.g., allowing recipients more time to complete their projects in the fiscal year).
  15. The Terms and Conditions for the Program need to be revised in line with the new TB Policy on Transfer Payments. The revisions relate to adding additional sections to be in compliance with the new policy (e.g. official languages), including formal linkages with IC’s Contributions Program, and updating the TCs and performance measurement strategy in line with the findings of this evaluation. These revisions are considered minor amendments (as defined by the Directive on Transfer Payments) and the responsible Minister may approve these changes. However, the OPC should consult Treasury Board Secretariat when renewing the T
  16. Cs to discuss whether Treasury Board approval is needed before implementing any changes (Policy on Transfer Payments).

Top of Page Table of Contents6. Recommendations

The following recommendations are provided for OPC consideration in renewing the Contributions Program:

  1. The OPC should draft new Terms and Conditions for the Program, in line with the recommended changes noted in Section 4 to align with the new Treasury Board Policy on Transfer Payments.
  2. The OPC should consider defining specific priorities for the Contributions Program that are derived from the overall OPC priorities, but are more focussed to direct project submissions, and that change annually to reflect changing privacy trends and needs. In addition, the OPC should consider reserving some funds (e.g., 10%) for projects in areas that are outside the priorities but relate to the overall goal of the program and PIPEDA.
  3. The OPC should consider mechanisms to promote the Program more broadly to the appropriate public education and outreach community.
  4. The OPC should establish an earlier launch date (e.g., Fall) and a more streamlined review, approval and contribution agreement process to ensure projects have a full year for project implementation. As well, the OPC should consider allowing for a small number of 2 year projects, as justified by specific proposals.
  5. The OPC should adjust the application process in the following ways:
    • Move towards an online application process to streamline requirements for applicants, and increase administrative efficiencies.
    • Require proposals to identify in-kind costs being provided and encourage (but not require) other sources of funding to the project.
    • Require successful applicants to report on their performance, in line with the overall performance measurement strategy [N.B. program staff should work with proponents at the contribution agreement stage to ensure applicants understand what should be tracked and reported to OPC].
  6. The OPC should implement the performance measurement strategy for the Program so that its overall results and impacts are tracked and summarized annually.
  7. The OPC should draft an annual report of program accomplishments and results that is provided to Senior Management, OPC’s Research, Public Education and Policy Branches, the media, and the privacy community (e.g., via the channels used to launch the Program).
  8. The OPC should create formal linkages with IC’s Contributions Program for Non-profit Consumer and Voluntary Organizations. These linkages should involve: sharing information at the launch stage for joint program promotion; sharing information at the proposal review stage to eliminate potential duplication and use expert resources in proposal review; and, sharing results after projects are completed to build on and promote each program’s accomplishments. The OPC should also consider how best to partner with and/or promote privacy related research with SSHRC.
  9. The OPC should consider assigning an additional 0.5 to 1 FTE to the administration of the program, under the direction of the Program Manager, to assist with: creating greater efficiencies in the proposal launch/review/negotiation process; promoting the program more broadly; providing more feedback to unsuccessful applicants; linking with IC’s Contributions Program; tracking performance; and, annual reporting.

Top of Page Table of ContentsAppendices

Inventory of Materials
Interviews Conducted
Name Organisation
1. Colin McKay OPC, Director of Research
2. François Cadieux OPC, Contributions Program Manager
3. Barb Dewtie Crime Prevention Society of Nova Scotia
4. Geneviève Reed Options consommateurs
5. Christian Boudreau École nationale d'administration publique
6. Avner Levin Ryerson University
7. David Lyon Queen’s University
8. Pippa Lawson Canadian Internet Policy and Public Interest Clinic
9. Cathy Wing Media Awareness Network
10. Kevin Haggerty University of Alberta
11. Steve Virtue Canadian Marketing Association
12. Stephen Hollander British Columbia Institute of Technology
13. Allan McCullough Child Safety Research & Innovation Center
14. Luigi Logrippo Université du Québec en Outaouais
15. Dragana Martinovic University of Windsor
16. Pradeep Kumar Atrey University of Winnipeg
17. Carman Baggaley Senior Policy Advisor, OPC
18. Raymond D’Aoust Senior Advisor to Privacy Commissioner and former Assistant Privacy Commissioner, OPC
  1. 1 Evaluation Plan for the Personal Information Protection and Electronic Documents Act Class Contribution Program. Final Report. March 31, 2009. Government Consulting Services.
  2. 2OPC Website, http://www.privcom.gc.ca/aboutUs/eac_e.asp, February 26th 2009.
  3. 3 Appendix A to the Treasury Board Submission - Terms and Conditions: The Personal Information Protection and Electronic Documents Act Class Contribution Program.
  4. 4 Appendix A: Terms and Conditions, the Personal Information Protection and Electronic Documents Act Class Contribution Program, p 5.
  5. 5 Report of Plans and Priorities, Office of the Privacy Commissioner of Canada, 2008-2009, http://www.tbs-sct.gc.ca/rpp/2008-2009/inst/ipc/ipcpr-eng.asp?format=print
  6. 6Interim or advance payments require a progress report of work done to-date.
  7. 7The OPC has its financial statements verified by the OAG annually, so it indirectly includes the contributions funds.
  8. 8This includes those elements in the Directives Appendix B-Core Design Elements and Appendix E–T&Cs for Contributions.