2017-18 Departmental Plan

Office of the Privacy Commissioner of Canada

 

(Original signed by)

The Honourable Jody Wilson-Raybould, P.C., Q.C., M.P
Minister of Justice and Attorney General of Canada


© Her Majesty the Queen in Right of Canada, as represented by
the Minister of Justice and Attorney General of Canada, 2017

Catalogue No. IP51-6E-PDF
ISSN 2371-7955


Message from the Privacy Commissioner of Canada

Daniel TherrienI am pleased to submit the 2017-18 Departmental Plan on behalf of the Office of the Privacy Commissioner of Canada (OPC). Our 2017–18 Departmental Plan provides parliamentarians and Canadians with information on what we do and the results we are trying to achieve during the upcoming year. To improve reporting to Canadians, we are introducing a new, simplified report to replace the Report on Plans and Priorities.

The title of the report has been changed to reflect its purpose: to communicate our annual performance goals and the financial and human resources forecast to deliver those results. The report has also been restructured to tell a clearer, more straightforward and balanced story of the actual results we are trying to achieve, while continuing to provide transparency on how tax payers’ dollars will be spent. We describe our programs and services for Canadians, our priorities for 2017–18, and how our work will fulfill our departmental mandate.

Since defining our strategic privacy priorities in 2015-16, we have enhanced our efforts to give Canadians more control over their personal information. Faced with increases in both the volume and complexity of our work, we used our strategic privacy priorities to help channel our resources and efforts to those areas that will have a greater impact for Canadians.

Our task for 2017-18 is to continue supporting Canadians in the protection of their privacy, proactively through advice and guidance and by responding to complaints filed under the public sector Privacy Act and private sector Personal Information Protection and Electronic Documents Act. We will also assist public sector and private sector institutions and organizations meet their privacy obligations, and respond to an encouraging increase in attention to privacy issues by Parliamentarians.

We will continue implementing concrete proactive action plans to advance the OPC’s privacy priorities on issues such as strengthening the consent model, online reputation, national security, privacy enhancing technologies, digital health technologies and outreach strategies to reach vulnerable groups and small businesses.

Recognizing that privacy issues are becoming increasingly borderless in nature and can impact millions of people around the world, we will continue to leverage and build upon relationships with our provincial, territorial and international partners. We will seek out productive collaboration with academia, civil society groups, industry, and others with a similar interest in boosting the control Canadians have over their personal information.

We will also work to maintain flexibility in service delivery, improve the timeliness of our service to Canadians and support the modernization of Canada’s legislative, legal and regulatory privacy frameworks.

In the OPC’s 2015-16 Annual Report to Parliament, I said that we need to update the tools available to protect Canadians’ personal information. Succeeding in our mission to protect and promote privacy rights, while keeping up with the constant and accelerating pace of technological change, has been—and will continue to be—a challenge. With a carefully crafted roadmap as outlined in this report, and a committed team of privacy-minded professionals, my Office will strive to make an impact on the private lives of Canadians with the tools currently at our disposal.

(The original signed by)

Daniel Therrien
Privacy Commissioner of Canada

Plans at a glance

1. Advance the OPC’s privacy priorities

In 2015, the OPC adopted the privacy priorities that will guide its proactive work through to 2020 in order to ensure that the Office remains ahead of the curve on key, emerging areas that are likely to have the greatest impact on the protection of Canadians’ personal information. These priorities enhance the Office’s ability to inform parliamentarians, as well as to protect and promote the privacy rights of Canadians. They also allow the OPC to better leverage its limited resources.

Work will continue in 2017-18 to advance the priorities through the implementation of concrete action plans. At the end of the period, the OPC will have:

  • completed its stakeholder consultations on how to strengthen the consent model under the Personal Information Protection and Electronic Documents Act (PIPEDA), and will have identified improvements, begun implementing those within OPC jurisdiction, and recommended legislative changes, if required;
  • developed a strategy for how the OPC will support the effective use of data anonymization, or de-identification;
  • developed its position on the right to be forgotten in Canada, or other recourse mechanisms to manage and address issues related to individuals' online reputations as a result of information posted about them or by them;
  • completed a systematic review of Privacy Enhancing Technologies (PETs) with the view of informing Canadians of the general types of privacy enhancing technologies available, and helping advance research and knowledge in this area;
  • furthered the development of network analysis tools in its technology lab and applied them to several consumer products;
  • completed its first review of the implementation of the Security of Canada Information Sharing Act examining how information sharing is occurring between federal institutions to ensure the implementation of the new provisions respects the Privacy Act;
  • further enhanced the usability of the new OPC website to ensure it is providing Canadians with the information they need;
  • updated and produced information and advice to help individuals exercise their rights and increase their control over their personal information; and
  • advanced outreach strategies to reach small businesses and vulnerable groups such as youth and seniors in order to increase awareness of privacy rights and responsibilities among these key audiences.

2. Support government and parliamentary initiatives to reform federal privacy legislation

In 2016, Parliament signaled its interest in first studying the Privacy Act, followed by a study beginning in late 2016/early 2017 on the Personal Information Protection and Electronic Documents Act. The OPC will participate actively in these legislative review processes. These laws are the foundation for protecting Canadians’ privacy and establishing the public trust needed to enable an innovative and thriving digital economy, and a nimble and effective government to serve its citizenry. Canadians expect modernized privacy laws that are in step with evolving technologies and in line with the rest of the world. They increasingly demand, and deserve, transparency and accountability on the part of organizations and institutions they deal with. And they no doubt want to embrace the benefits of innovation, confident that their personal information is being protected, and that societal boundaries of what is responsible, fair and ethical are being respected.

The OPC will participate in the parliamentary study on the Personal Information Protection and Electronic Documents Act, and expects its work on consent and reputation to inform that study. It will also participate in the government’s study/review of the Privacy Act, regardless of the form or timeline. Should a Bill be introduced that makes consequential amendments to the Privacy Act as a result of anticipated reforms to the Access to Information Act, the OPC will also provide comment on any such changes.

3. Enhance organizational capacity and agility

The OPC must continuously make the best use of existing human and financial resources to deal effectively with an ever-increasing volume and complexity of work, while meeting the expectations of the public and other stakeholders in addressing privacy concerns. To maximize efficiency and impact, the Office must continue to maintain flexibility in service delivery and the use of its compliance tools in an environment of rapidly evolving technologies and privacy issues.

These efforts will continue in 2017-18, notably through:

  • implementing streamlined procedures for Privacy Act investigations;
  • implementing a PIPEDA compliance monitoring function, including exploring ways to harness the full potential of Compliance Agreements to maximize the effectiveness of investigations within existing organizational resources;
  • leveraging its information holdings to inform both its outreach and compliance work;
  • reviewing its technology analysis services, a key function that supports both the OPC's compliance work and the advancement of its privacy priorities;
  • examining the best practices of other organizations to improve service delivery of the Information Centre.

The OPC’s goal through these initiatives is to improve the timeliness of its services to Canadians and strengthen its oversight of compliance with federal privacy legislation.

4. Enhance strategic partnership and collaboration opportunities

Many privacy issues are borderless in nature and require the OPC to collaborate with provincial and international partners. Further enhancing collaboration and engagement with federal, provincial and international partners, as well as organizations representing consumers, industry and others, helps the OPC develop effective and relevant guidance and ensure that it is made available to individuals and organizations across Canada. Working in tandem with provincial and international counterparts helps to maximize expertise and resources to achieve positive privacy outcomes for Canadians.

In the coming year, the OPC will continue to identify and build relationships with new stakeholders and leverage the value of newer and longstanding partnerships. For instance, the Commissioner will continue to serve on the Executive Committee of the International Conference of Data Protection and Privacy Commissioners, contributing to its role in influencing global policy leadership and setting future directions for this important community.

The Office will also:

  • co-host the Asia-Pacific Privacy Authorities (APPA) meeting in Vancouver in late 2017 where it will showcase its Contribution Program, featuring Canadian-funded research and knowledge translation projects on privacy issues;
  • continue to build productive relationships with relevant standards bodies, industry and academia to influence the future direction of standards development that impact privacy;
  • examine, with its enforcement partners, the impact of the first three years of Canada's anti-spam legislation; and
  • identify, engage and collaborate with numerous stakeholder groups to better reach small businesses, youth and seniors through their trusted sources.

For more information on the OPC’s plans, priorities and planned results, see the “Planned results” section of this report.

Raison d’être, mandate and role: who we are and what we do

Raison d’être

As an Agent of Parliament, the Privacy Commissioner of Canada reports directly to the House of Commons and the Senate. The mandate of the Office of the Privacy Commissioner of Canada (OPC) is to oversee compliance with both the Privacy Act, which covers the personal information-handling practices of federal government institutions, and PIPEDA, Canada’s federal private sector privacy law, along with some aspects of Canada’s anti-spam law (CASL). The OPC’s mission is to protect and promote the privacy rights of individuals.Footnote 1

Mandate and role

The Privacy Commissioner’s powers to further the privacy rights of Canadians include:

  • investigating complaints, conducting audits and pursuing court action under the Privacy Act and PIPEDA;
  • publicly reporting on the personal information-handling practices of public and private sector organizations;
  • supporting, undertaking and publishing research into privacy issues; and
  • promoting public awareness and understanding of privacy issues, including appearing before Parliament on proposed legislation and studies on issues affecting the privacy rights of Canadians.

The Commissioner works independently of government to investigate federal public sector-related complaints from individuals under the Privacy Act and complaints related to the private sector under PIPEDA. He also has some designated responsibilities to ensure compliance with CASL.

The Commissioner may address complaints through mediation and conciliation; he also has the power to summon witnesses, administer oaths, and compel the production of evidence. In cases where the investigation does not result in a voluntary agreement/resolution and remains unresolved, the Commissioner may seek an order from the Federal Court to address the situation under certain circumstances.

For more general information about the OPC, see the “Supplementary information” section of this report.

Operating context: conditions affecting our work

The OPC’s strategic and operating environment continues to evolve with the rapid rate of technological change, which is outpacing the accompanying privacy protections. New and sophisticated techniques continue to be developed to track, use, and sometimes compromise personal information. These issues pose formidable challenges to the OPC and its counterparts around the world.

Privacy issues are becoming more inter-disciplinary and cross-jurisdictional. This year, the OPC has again made developing and enhancing partnerships with stakeholders a key priority. Work will continue to increase information-sharing and coordination efforts with other national and international data protection authorities in order to strengthen global enforcement and enhance policy development.

There is also continuing interest from both public and private sector organizations to expand how they access and use personal information, often in ways that increasingly stretch current legal and governance structures. New economic models are emerging based on the mining of personal information.

The OPC has also responded to the welcomed increase in attention to privacy issues by Parliamentarians. Specifically, Parliament is undertaking reviews of both federal privacy laws for which OPC has oversight responsibilities: the Privacy Act and PIPEDA. As an agent of Parliament, this surge in interest in privacy issues is encouraging.

The increasing amount of personal information exchanged between private and public sector organizations continues to pose challenges to privacy and accountability. Initiatives to expand surveillance powers, facilitate warrantless disclosures, or broaden government access to personal information held by private sector organizations have given rise to heightened privacy concerns.

Growing awareness about government surveillance has also generated proposals to reform existing oversight and control measures. This past year, the federal government launched a consultation on national security, to which the OPC made a joint submission with its provincial and territorial counterparts from across the country. The Office anticipates further discussion on this issue with Parliament and the government in the year to come. The OPC has made government surveillance one of its four privacy priorities and will continue to dedicate resources to reviewing the information sharing practices of federal departments and agencies in the context of national security to ensure privacy compliance and inform public debate and awareness.

In addition to the issues noted above, other developments are contributing to an increase in the volume and complexity of the OPC’s workload. They include, for example, new mandatory breach notification requirements in the public sector, increasing concerns about private sector breaches, the increased complexity of complaints and investigations and rapidly evolving information technologies.

To elaborate on that first example, new mandatory breach notification provisions for the private sector are poised to expand the OPC’s mandate. The Digital Privacy Act (formerly known as Bill S-4), received Royal Assent in June 2015, resulting in a number of significant amendments to PIPEDA. Many amendments came into force upon Royal Ascent; however, those dealing with breach reporting, notification and recordkeeping will be brought into force once related regulations are developed and in place.

The OPC will continue to meet its challenges by focussing on advancing its privacy priorities as much as possible, while also actively leveraging its resources to provide timely and informed advice to Parliament and other stakeholders.

Key risks: things that could affect our ability to achieve our plans and results

Key risks

As noted in the previous section, the rapid rate of technological change has had a profound impact on privacy protection. Technologies such as always-on smartphones, geo-spatial tracking tools, wearable computing, cloud computing, Big Data (advanced analytics), genetic profiling, and the Internet of Things (IoT) raise significant, novel and highly complex privacy issues. These developments impact both the private and public sectors in ways that test legal boundaries, but also necessitate critical reflection and inclusive debate on appropriate ethical parameters.

To remain effective the OPC must develop and maintain a high level of privacy expertise and become increasingly knowledgeable of an ever-expanding range of issues – the technologies mentioned above are but a few examples. The Office is also increasingly challenged by the privacy risks posed by new legislation, and corporate business models that use personal data in novel ways, often affecting the private lives of Canadians.

The constant and accelerating pace of technological innovation, its expanding adoption by private and public organizations, and its profound impact on privacy protection create challenges for our Office’s legislative and policy agenda, as well as its capacity to deliver on core activities: investigations, guidance, public education, and research.

The challenges and risks to privacy protection are discussed in the OPC’s most recent Annual Report to Parliament on the Personal Information Protection and Electronic Documents Act and the Privacy Act. As noted in this report, in both the public and private sectors, it is clear that the tools available to protect Canadians’ personal information need to be updated in order to maintain the trust and confidence citizens have in federal institutions and in the digital economy.

Risks Risk response strategy Link to the department’s Programs Link to departmental priorities
Effective oversight of compliance with federal privacy legislation

Risk related to programs and business activities with high privacy risks not being reviewed by the OPC because of limited resources.
  • Continue to prioritize the review of PIAs that present the highest privacy risks.
  • Develop and implement streamlined criteria to action breach reports under PIPEDA, and look to increased collaboration with international and domestic partners where appropriate.
  • Using available resources, continue to prioritize PA breaches based on a risk management framework.
Compliance Activities Enhance organizational capacity and agility
Maintain and recruit the right skillset

Risk related to the OPC’s ability to maintain or recruit the right skillset to effectively deliver on its mandate given the increasingly complex and rapidly evolving privacy landscape.
  • Implement the Integrated Business and Human Resource Plan which includes strategies to support the organization's needs.
  • Continue the OPC Privacy Conversations, Tech Talks and Tech Blog series to build capacity and share knowledge on evolving privacy and technological issues.
  • Continue to learn and disseminate knowledge from cutting-edge research funded through the Contributions Program.
  • Explore an Investigator Development Program (IDP) and implement where appropriate.
  • Compliance Activities
  • Research and Policy Development
  • Public Outreach
Enhance organizational capacity and agility
Achieving progress in advancing the OPC privacy priorities

This risk related to the OPC’s ability to deliver on all its privacy priority commitments as the volume of responsive work continues to increase across the organization.
  • Continue to closely monitor progress against plans to advance its privacy priorities and refine them as needed to ensure they continue to be feasible.
  • Conduct a formative evaluation to measure progress to date and early impact of its work in advancing the privacy priorities.
  • Compliance Activities
  • Research and Policy Development
  • Public Outreach
Advance the OPC privacy priorities

Planned results: what we want to achieve this year and beyond

Programs

Compliance Activities

This program oversees compliance with federal privacy legislation for public and private sector organizations, thus contributing to the protection of Canadian’s privacy rights. Through this Program, the OPC investigates privacy-related complaints and responds to inquiries from individuals and organizations, reviews breach reports and has the power to initiate its own investigations when warranted (Commissioner initiated complaints). Through audits and reviews, the OPC also assesses how well organizations are complying with requirements set out in the two federal privacy laws, and provides recommendations on Privacy Impact Assessments (PIAs), pursuant to the Treasury Board Directive on Privacy Impact Assessment. This program is supported by a legal team that provides specialized advice and litigation support, and a research team with senior technical and risk-assessment support.

Planning highlights

Providing Canadians with the level of privacy protection they expect and deserve is what drives the OPC’s work under this program. However, the Office continues to face a growing volume and complexity of compliance work, making it increasingly difficult to provide effective oversight of compliance with federal privacy legislation and respond to complaints and information requests within its service standards. The OPC has seen an overall upward trend in breach reporting since 2008-09 and breach reporting is expected to sharply increase once mandatory breach notification for private sector breaches comes into force.

A suite of introspective lean exercises has resulted in enhanced efficiency and program delivery in recent years. Such exercises have yielded tangible results including increased use of informal mediation processes, reduced treatment times for PIAs and most investigations, expanded use of delegation, more efficient requests for, and delivery of, legal advice, and the introduction of risk management frameworks supporting pragmatic triage and proactive management of legal risks at the OPC. Yet, at the time of writing this report, the number of active Privacy Act investigations over 12 months has increased by 45 per cent since this time last year.Footnote 2

The volume and complexity of compliance work is expected to continue in the years to come. This is why the OPC must sustain its efforts to find efficiencies and make optimal use of its resources. In the coming year the Office will examine the best practices of other departmental services similar to its Information Centre, to ensure it is making the best use of its limited resources, and providing the best possible service to Canadians and organizations who contact our Office for information on their privacy rights and obligations.

With the aim of enhancing organizational capacity and agility, the Office will continue to implement and monitor investigative approaches and procedures that are streamlined, innovative, and flexible. For investigations under the Privacy Act, the Office will evaluate the strengthened use of early resolution, develop guidance and increased training on summary investigations, introduce a Quality Assurance and Quality Control program, and begin implementation of revised procedures for certain investigations. For investigations under PIPEDA, the Office will continue to implement a dedicated Compliance Monitoring Unit charged with the responsibility of monitoring and assessing whether organizations are abiding by compliance agreements and other investigation-associated undertakings, and will introduce early resolution investigation procedures to the Toronto Regional Office’s portfolio. These activities will encourage private sector organizations’ compliance with federal privacy legislation and are expected to result in timelier investigations.

The OPC will continue judicious use of its legal resources to initiate, or intervene in, litigation cases that have the potential of advancing privacy law in Canada and/or are capable of having significant impact on the privacy rights of Canadians. Whenever invited to do so, the OPC will consider playing an amicus role or serve as “friend of the Court” in lending its privacy expertise on complex and highly specialized privacy legal matters.

The OPC has made government surveillance one of its four privacy priorities and will continue to dedicate resources to review PIAs, as well as review and investigate the collection, use and sharing practices of federal sector organizations involved in surveillance activities. The Office will also undertake its third review of the measures taken by the Financial Transactions and Reports Analysis Centre of Canada to protect information it receives or collects under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act. The next phase of the OPC’s review of the Security of Canada Information Sharing Act (SCISA) will focus on verifying the details and nature of the personal information-sharing activity pursuant to SCISA, in part to confirm the information given to us by departments. It will also examine the exchange of personal information for national security purposes using legal authorities other than SCISA. The Office’s goal is to provide as clear a picture as it can of the use of SCISA and other authorities, to inform the public and parliamentary debate that will take place in the course of the government review of Bill C-51, and to ensure compliance with the Privacy Act.

In the international sphere, the Office will continue to expand its networks to remain responsive to increasingly complex privacy issues that overlap more and more with other areas, such as consumer protection. As executive members of GPEN and the International Conference, the OPC continues to lead on the development of tools that facilitate increased international cooperation and create opportunities to foster and leverage strategic partnerships. Domestically, the Office will continue to (i) expand enforcement collaboration with provincial privacy regulators, and (ii) collaborate with key federal partners on CASL-related investigations. These initiatives will enhance organizational capacity by facilitating the sharing of practical investigative strategies with the aim of achieving efficiencies and optimizing the effectiveness of available resources.

Planned results
Expected Results Performance Indicators Target Date to achieve target 2013–14 Actual resultsFootnote 3 2014–15 Actual results 2015–16 Actual results
Federal government institutions and private-sector organizations meet their obligations under federal privacy legislation. Percentage of complaints and incidents (breach notifications and OPC interventions) that are resolved to the satisfaction of the OPC 85% March 31, 2018 n/a 76% 79%
Percentage of audit recommendations substantially implemented two years after publication of the final audit report 85% March 31, 2018 n/a 100% 100%
Individuals receive responses to their information requests and complaints. Percentage of information requests and complaints responded to within established service standards 90% March 31, 2018 n/a 96%Footnote 4 83%
Federal government institutions and private sector organizations receive advice and recommendations to improve their privacy practices, in compliance with federal privacy legislation and policies. Percentage of PIA-related advice that results in added privacy protection for government programs or initiatives 90% March 31, 2018 90% 94% 93%
Budgetary financial resources (dollars)
2017-18 Main Estimates 2017-18 Planned Spending 2018-19 Planned Spending 2019-20 Planned spending
11,619,666 11,619,666 11,619,666 11,619,666
Human resources (Full-time equivalents)
2017-18 Planned full-time equivalents 2018-19 Planned full-time equivalents 2019-20 Planned full-time equivalents
87 87 87

Research and Policy Development

This program advances privacy knowledge, develops policy positions and provides strategic advice on the full range of privacy issues to Parliamentarians, government institutions and private sector stakeholders.

Through this program, the OPC serves as a centre of expertise on emerging privacy issues in Canada and abroad by researching trends and technological developments, monitoring and analysing legislative and regulatory initiatives, providing strategic legal, policy and technical advice on key issues, and developing policy positions that advance the protection of privacy rights in both the public and private sectors.

An important part of the work involves supporting the Commissioner and senior officials in providing advice to Parliament on potential privacy implications of proposed legislation, government programs, and private-sector initiatives. Since 2004, the Program includes the administration of the Personal Information Protection and Electronic Documents Act Contributions Program that funds independent privacy research and related knowledge translation initiatives, to advance knowledge and promote the practical application of that knowledge in ways that enhance privacy protection for Canadians.

Planning highlights

One of the key activities that this program will be undertaking is contributing to the government study of the Privacy Act, and Parliament’s study of PIPEDA. The OPC has been advocating for many years that the Privacy Act is in need of modernization. In 2016-17, the Office provided Parliament with recommendations on how best to modernize the law. The government has signaled its intention to review the law, with a view to ensuring that Canadians are able to engage with their government; in order to do so, Canadians need to trust that doing so will “never make us vulnerable to manipulation or unjustified intrusions on our privacy.”Footnote 5 It is clear that the government intends to undertake a broad review, and it will be crucial for the OPC to contribute to this study.

Work undertaken in recent years under the OPC’s privacy priorities, particularly with respect to strengthening consent and protecting online reputation, will also help shape the Office’s position on matters related to Parliament’s study of PIPEDA. After consulting with stakeholders in 2016-17, the OPC will issue positions on these two issues in 2017-18. The Office will complete a systematic review of Privacy Enhancing Technologies (PETs) with the view of informing Canadians of the general types of privacy enhancing technologies available, and helping advance research and knowledge in this area. The OPC will also work on enhancing the network analysis tools in its technology lab and applying them to several consumer products in order to help inform Canadians of the privacy risks involved with certain Internet-connected devices. The Office will also determine appropriate means of sharing its procedures and collaborating with other data protection authorities, and will consider the development of guidance for stakeholders that wish to assess Internet connected devices.

In recent years, the OPC has experienced a steady increase in Parliamentary requests for input from our Office on bills and studies. Other than the work of the Standing Committee on Access to Information, Privacy and Ethics, the OPC is (at the time of writing) actively monitoring eight other studies and is engaged in monitoring and preparing for possible engagement on 10 bills with privacy implications that are currently before Parliament. As well, recently proposed changes to rules in the Senate may require the Privacy Commissioner to appear in the Senate Question Period. It is not known at this time what the impact of those changes will be. We can expect that these trends will continue in the foreseeable future.

The Office is also responding to an increasing number of government public consultations that may overlap with Parliamentary studies. One prominent example was the government’s consultation on national security. Government surveillance is one of the Office’s privacy priorities, and the OPC participated in both the government consultation and the Parliamentary Study on National Security. In 2017-18, the Office expects further discussions on national security with government and Parliament.

The OPC intends to continue its research work with a view to advancing knowledge of privacy risks and privacy-enhancing solutions, and sharing this knowledge in the form of practical guidance for stakeholders. For example, the Office anticipates issuing guidance to developers of digital health technologies, which speaks to enabling better privacy practices on the part of organizations. This was an area in which the Office conducted an environmental scan and a GPEN sweep in 2016-17. The OPC’s consent and reputation consultation work may also result in issuing guidance in areas related to those studies, including on de-identification and anonymization.

Calls under the Contributions Program are also increasingly being focused on cutting-edge, innovative solutions to privacy issues across all the priorities. Indeed, as an example of this, the OPC call for proposals for projects in 2017-18 encourages applicants to develop sectoral Codes of Practice.Footnote 6 Such codes are intended to support and enable stakeholders to:

  • Enhance organizational accountability;
  • Promote regulatory compliance through greater certainty and predictability; and
  • Augment information to individuals beyond privacy policies, helping to promote transparency and openness with respect to how privacy obligations are met and addressed.
Planned results
Expected Results Performance Indicators Target Date to achieve target 2013–14 Actual resultsFootnote 7 2014–15 Actual results 2015–16 Actual results
Public and private sector stakeholders are enabled to develop policies and initiatives that respect privacy rights. Percentage of stakeholder requests for guidance on policies and initiatives that were responded to by the OPC 100% March 31, 2018 n/a 100% 100%
Parliamentarians are able to draw on OPC expertise to identify and address privacy issues. Percentage of requests from parliamentarians that were responded to by the OPC within service standards 100% March 31, 2018 n/a 100% 100%
Knowledge of privacy issues is advanced. Increased take-up of OPC research Annual increase relative to previous year March 31, 2018 7,632 visits (baseline year) 24% increase 326,882 (new baseline)Footnote 8
Budgetary financial resources (dollars)
2017-18 Main Estimates 2017-18 Planned Spending 2018-19 Planned Spending 2019-20 Planned spending
3,234,249 3,234,249 3,234,249 3,234,249
Human resources (Full-time equivalents)
2017-18 Planned full-time equivalents 2018-19 Planned full-time equivalents 2019-20 Planned full-time equivalents
25 25 25

Public Outreach

This Program promotes public awareness and understanding of rights and obligations under federal privacy legislation. Through this program, the OPC delivers public education and communications activities, including speaking engagements and special events, exhibiting, media relations, and the production and distribution of promotional and educational material.

Through public outreach activities, individuals are informed about privacy and personal data protection. Such activities also enable federal and private-sector organizations to better understand their obligations under federal privacy legislation.

Planning highlights

In a survey conducted by the OPC in 2016, 65 per cent of Canadians rated their knowledge of privacy rights as good or very good. While this result is encouraging, there is still a need to better educate individuals about their privacy rights, so they can make informed privacy decisions to protect themselves. Businesses also need to increase their awareness of privacy obligations to ensure they are able to comply.

In order to have an impact on awareness levels of privacy rights and obligations, the OPC’s public education activities are designed to advance the OPC’s strategic privacy priorities. They also seek to enhance strategic partnerships and collaboration opportunities. The demand and need for information about privacy protection, however, far exceeds the OPC’s capacity to respond.

In the year ahead, the OPC will refine, update and continue to implement outreach strategies targeting Canadians—in particular, youth and seniors—as well as small businesses. It will implement communications and outreach strategies to enable vulnerable groups to better protect their privacy. Through its communications and outreach initiatives aimed at children and youth, the OPC will continue to work with parents, teachers, librarians, various youth-serving organizations, and other trusted sources to provide information and guidance on online privacy risks and how to mitigate them. The OPC’s seniors communications and outreach strategy involves providing information to seniors to inform them of privacy issues in both the online and bricks and mortar world—with a special emphasis on identity theft, mobile devices and online privacy—and help them better protect their privacy and control their personal information.

The OPC will also reach out to small businesses to help them understand their privacy obligations under Canada’s federal private sector privacy law – and ultimately better protect the personal information of their customers. The OPC will continue to undertake both broad-based and targeted communications and outreach activities to reach small businesses. The OPC will continue to make an effort to reach out to the accommodations and retail sectors, which have generated more complaints relative to other sectors. An updated small business outreach strategy will focus on developing resources to help businesses meet requirements set out under PIPEDA and disseminating information, for example, via associations and business organizations. The OPC will also explore proposed approaches to an advisory capacity initiative for small businesses, which have been identified as being less likely to have in-house resources to advise on privacy matters.

The Office will expand its targeted efforts to include new sectors, such as the legal community and organizations that have adopted new online business models where the collection and use of personal information is key.

The OPC’s newly revamped website is its primary tool for reaching Canadians – with more than two million visits to the website per year. In the coming year, the OPC will continue to enhance its website to the benefit of individuals and organizations. It will:

  • develop new content offering concrete, practical advice for individuals on protecting personal information in an increasingly complex digital environment;
  • develop new—and update existing—tools and information for businesses that will help them meet their privacy obligations under PIPEDA and the expectations of their customers;
  • conduct web usability testing and assess its Web content to ensure the website is meeting the information needs of Canadians and organizations, and implement enhancements as needed; and
  • establish an approach to manage the lifecycle of information available on the OPC website, to help ensure individuals and organizations have what they need.
Planned results
Expected Results Performance Indicators Target Date to achieve target 2013–14 Actual results 2014–15 Actual results 2015–16 Actual results
Federal government institutions and private-sector organizations better understand their obligations under federal privacy legislation and individuals better understand their rights. Percentage of private-sector organizations that are moderately or highly aware of their obligations under federal privacy legislation 85% March 31, 2018 87% Not a survey year 82%
Percentage of Canadians who feel they know their privacy rights 70%Footnote 9 March 31, 2019 Not a survey year 32% Not a survey year
Federal government institutions and private-sector organizations have access to useful information about their privacy responsibilities and individuals have access to relevant and timely information to protect their privacy rights. Annual increase in website visits Visits to OPC websites increase year over year March 31, 2018 (15%) 31% 5%
Budgetary financial resources (dollars)
2017-18 Main Estimates 2017-18 Planned Spending 2018-19 Planned Spending 2019-20 Planned spending
2,869,950 2,869,950 2,869,950 2,869,950
Human resources (Full-time equivalents)
2017-18 Planned full-time equivalents 2018-19 Planned full-time equivalents 2019-20 Planned full-time equivalents
21 21 21

Internal Services

Internal Services are those groups of related activities and resources that the federal government considers to be services in support of programs and/or required to meet corporate obligations of an organization. Internal Services refers to the activities and resources of the 10 distinct service categories that support Program delivery in the organization, regardless of the Internal Services delivery model in a department. The 10 service categories are: Management and Oversight Services; Communications Services; Legal Services; Human Resources Management Services; Financial Management Services; Information Management Services; Information Technology Services; Real Property Services; Materiel Services; and Acquisition Services.

Planning highlights

The OPC’s Internal Services will continue to support the organization in delivering its mandate and its priorities, and implement mandatory Government of Canada transformation initiatives.

The implementation of a new Department Results Framework will strengthen performance measurement at the OPC and will facilitate greater reporting on results to Parliamentarians and Canadians.

The Office’s Integrated Business and Human Resources Plan 2016-19 will support the organization in making business and organizational changes to deliver quality service to Canadians; enable the Office to recruit skilled, diverse people; engage and develop its employees; and create a healthy, respectful workplace.

A formative evaluation of the OPC's privacy priorities work will provide insight into progress to date in advancing the four priorities and will support management in determining any needed course correction to make sure the Office’s work under these priorities is contributing to desired outcomes.

The implementation of the OPC’s Information Management and Information Technology (IT) strategies will ensure that the systems and services offered meet clients’ needs while also improving information management practices and maintaining a sound IT infrastructure.

Opportunities to partner with other Agents of Parliament will continue to be explored to gain effectiveness, share knowledge and continue implementing best practices in areas such as information technology, administrative services, training, and human resources programs.

Budgetary financial resources (dollars)
2017-18 Main Estimates* 2017-18 Planned Spending* 2018-19 Planned Spending* 2019-20 Planned spending*
*Includes Vote Netted Revenue authority (VNR) of $200,000 for internal support services to other government organizations.
6,620,626 6,620,626 6,620,626 6,620,626
Human resources (Full-time equivalents)
2017-18 Planned full-time equivalents 2018-19 Planned full-time equivalents 2019-20 Planned full-time equivalents
48 48 48

Spending and human resources

Figure 1: Departmental spending trend graph

Text version of Figure 1

Departmental spending trend graph

The graph above illustrates the OPC spending trend from 2014-15 to 2019-20.

Fiscal year Total Voted Statutory Sunset Programs – Anticipated
2014–15 25,569,835 23,065,872 2,503,963 0
2015–16 24,989,912 22,571,075 2,418,837 0
2016–17 24,506,946 22,025,622 2,481,324 0
2017–18 24,344,491 22,075,133 2,269,358 0
2018–19 24,344,491 22,075,133 2,269,358 0
2019–20 24,344,491 22,075,133 2,269,358 0

Planned spending

Budgetary planning summary for Programs and Internal Services (dollars)
Programs and Internal Services 2014-15 Expenditures 2015-16 Expenditures 2016-17 Forecast spending 2017-18 Main Estimates 2017-18 Planned Spending 2018-19 Planned Spending 2019-20 Planned spending
Compliance 12,031,142 11,963,491 11,807,990 11,619,666 11,619,666 11,619,666 11,619,666
Research and Policy Development 3,040,117 2,942,391 3,278,434 3,234,249 3,234,249 3,234,249 3,234,249
Public Outreach 2,508,474 2,296,196 2,903,219 2,869,950 2,869,950 2,869,950 2,869,950
Subtotal 17,579,733 17,202,078 17,989,643 17,723,865 17,723,865 17,723,865 17,723,865
Internal Services 7,990,102 6,979,325 6,517,303 6,620,626 6,620,626 6,620,626 6,620,626
Total 25,569,835 24,181,403 24,506,946 24,344,491 24,344,491 24,344,491 24,344,491

Analysis of the Spending Trend

For fiscal years 2014-15 and 2015-16, actual spending represents the actual expenditures as reported in the Public Accounts of Canada.

The decrease in expenditures between 2014-15 and 2015-16 is mainly related to the Government of Canada’s move to salary payments in arrears in the context of Pay Modernization. Also, part of the decrease in expenditures is attributed to one-time residual work related to the 2014 move of the OPC headquarters to a new building at 30 Victoria Street in Gatineau, Quebec.

Projected spending for the fiscal year 2016-17 corresponds to the planned spending of the Office. It shows a slight increase over the previous year as a result of the inclusion of the carry forward from 2015-16.

The spending trend starting in 2017-18 remains fairly stable. The amounts essentially reflect a small decrease related to the change in the employee benefits plan.

Planned human resources

Human resources planning summary for Programs and Internal Services (full-time equivalents)
Programs and Internal Services 2014-15 Full-time equivalents 2015-16 Full-time equivalents 2016-17 Forecast full-time equivalents 2017-18 Planned full-time equivalents 2018-19 Planned full-time equivalents 2019-20 Planned full-time equivalents
Compliance 91 89 87 87 87 87
Research and Policy Development 17 20 25 25 25 25
Public Outreach 18 16 21 21 21 21
Subtotal 126 125 133 133 133 133
Internal Services 50 50 48 48 48 48
Total 176 175 181 181 181 181

Estimates by vote

For information on the OPC’s organizational appropriations, consult the 2017–18 Main Estimates.

Future-Oriented Condensed Statement of Operations

The Future Oriented Condensed Statement of Operations provides a general overview of the OPC’s operations. The forecast of financial information on expenses and revenues is prepared on an accrual accounting basis to strengthen accountability and to improve transparency and financial management.

Because the Future Oriented Condensed Statement of Operations is prepared on an accrual accounting basis, and the forecast and planned spending amounts presented in other sections of the Departmental Plan are prepared on an expenditure basis, amounts may differ.

A more detailed Future Oriented Statement of Operations and associated notes, including a reconciliation of the net cost of operations to the requested authorities, are available on the OPC’s website.

Future Oriented Condensed Statement of Operations for the year ended March 31, 2018 (dollars)
Financial information 2016-17 Forecast results 2017-18 Planned results Difference (2017-18 Planned results minus 2016-17 Forecast results)
Total expenses 28,420,515 28,034,339 (386,176)
Total revenues 100,000 200,000 100,000
Net cost of operations before government funding and transfers 28,320,515 27,834,339 (486,176)

Supplementary information

Corporate information

Organizational profile

Appropriate minister(s)Footnote 10: Jody Wilson-Raybould

Institutional head: Daniel Therrien

Ministerial portfolioFootnote 11: Department of Justice Canada

Enabling instrument(s): Privacy Act, R.S.C. 1985, c. P-21; Personal Information Protection and Electronic Documents Act, S.C. 2000, c.5

Year of incorporation / commencement: 1982

Reporting framework

The Office of the Privacy Commissioner of Canada’s Strategic Outcome and Program Alignment Architecture (PAA) of record for 2017–18 are shown below:

  • 1. Strategic Outcome: the privacy rights of individuals are protected
    • 1.1 Program: Compliance Activities
    • 1.2 Program: Research and Policy Development
    • 1.3 Program: Public Outreach
  • Internal Services

Supporting information on lower-level programs

The OPC does not have lower-level programs as part of its Program Alignment Architecture.

Supplementary information tables

The following supplementary information tables are available on the OPC’s website.

  • Disclosure of transfer payment programs under $5 million;
  • Upcoming evaluations over the next five fiscal years;
  • Upcoming internal audits for the coming fiscal year.

Federal tax expenditures

The tax system can be used to achieve public policy objectives through the application of special measures such as low tax rates, exemptions, deductions, deferrals and credits. The Department of Finance Canada publishes cost estimates and projections for these measures each year in the Report on Federal Tax Expenditures. This report also provides detailed background information on tax expenditures, including descriptions, objectives, historical information and references to related federal spending programs. The tax measures presented in this report are the responsibility of the Minister of Finance.

Organizational contact information

30 Victoria Street, 1st Floor
Gatineau, Quebec K1A 1H3
Canada

Telephone: 819-994-5444
Toll Free: 1-800-282-1376
Fax: 819-994-5424
TTY: 819-994-6591
OPC Website: www.priv.gc.ca

Appendix A: definitions

appropriation (credit)
Any authority of Parliament to pay money out of the Consolidated Revenue Fund.
budgetary expenditures (dépenses budgétaires)
Operating and capital expenditures; transfer payments to other levels of government, organizations or individuals; and payments to Crown corporations.
Core Responsibility (responsabilité essentielle)
An enduring function or role performed by a department. The intentions of the department with respect to a Core Responsibility are reflected in one or more related Departmental Results that the department seeks to contribute to or influence.
Departmental Plan (Plan ministériel)
Provides information on the plans and expected performance of appropriated departments over a three year period. Departmental Plans are tabled in Parliament each spring.
Departmental Result (résultat ministériel)
A Departmental Result represents the change or changes that the department seeks to influence. A Departmental Result is often outside departments’ immediate control, but it should be influenced by program-level outcomes.
Departmental Result Indicator (indicateur de résultat ministériel)
A factor or variable that provides a valid and reliable means to measure or describe progress on a Departmental Result.
Departmental Results Framework (cadre ministériel des résultats)
Consists of the department’s Core Responsibilities, Departmental Results and Departmental Result Indicators.
Departmental Results Report (Rapport sur les résultats ministériels)
Provides information on the actual accomplishments against the plans, priorities and expected results set out in the corresponding Departmental Plan.
full time equivalent (équivalent temps plein)
A measure of the extent to which an employee represents a full person year charge against a departmental budget. Full time equivalents are calculated as a ratio of assigned hours of work to scheduled hours of work. Scheduled hours of work are set out in collective agreements.
government-wide priorities (priorités pangouvernementales)
For the purpose of the 2017–18 Departmental Plan, government-wide priorities refers to those high-level themes outlining the government’s agenda in the 2015 Speech from the Throne, namely: Growth for the Middle Class; Open and Transparent Government; A Clean Environment and a Strong Economy; Diversity is Canada's Strength; and Security and Opportunity.
horizontal initiatives (initiative horizontale)
A horizontal initiative is one in which two or more federal organizations, through an approved funding agreement, work toward achieving clearly defined shared outcomes, and which has been designated (e.g. by Cabinet, a central agency, etc.) as a horizontal initiative for managing and reporting purposes.
Management, Resources and Results Structure (Structure de la gestion, des ressources et des résultats)
A comprehensive framework that consists of an organization’s inventory of programs, resources, results, performance indicators and governance information. Programs and results are depicted in their hierarchical relationship to each other and to the Strategic Outcome(s) to which they contribute. The Management, Resources and Results Structure is developed from the Program Alignment Architecture.
non budgetary expenditures (dépenses non budgétaires)
Net outlays and receipts related to loans, investments and advances, which change the composition of the financial assets of the Government of Canada.
performance (rendement)
What an organization did with its resources to achieve its results, how well those results compare to what the organization intended to achieve, and how well lessons learned have been identified.
performance indicator (indicateur de rendement)
A qualitative or quantitative means of measuring an output or outcome, with the intention of gauging the performance of an organization, program, policy or initiative respecting expected results.
performance reporting (production de rapports sur le rendement)
The process of communicating evidence based performance information. Performance reporting supports decision making, accountability and transparency.
planned spending (dépenses prévues)
For Departmental Plans and Departmental Results Reports, planned spending refers to those amounts that receive Treasury Board approval by February 1. Therefore, planned spending may include amounts incremental to planned expenditures presented in the Main Estimates.

A department is expected to be aware of the authorities that it has sought and received. The determination of planned spending is a departmental responsibility, and departments must be able to defend the expenditure and accrual numbers presented in their Departmental Plans and Departmental Results Reports.
plans (plan)
The articulation of strategic choices, which provides information on how an organization intends to achieve its priorities and associated results. Generally a plan will explain the logic behind the strategies chosen and tend to focus on actions that lead up to the expected result.
priorities (priorité)
Plans or projects that an organization has chosen to focus and report on during the planning period. Priorities represent the things that are most important or what must be done first to support the achievement of the desired Strategic Outcome(s).
program (programme)
A group of related resource inputs and activities that are managed to meet specific needs and to achieve intended results and that are treated as a budgetary unit.
Program Alignment Architecture (architecture d’alignement des programmes)
A structured inventory of an organization’s programs depicting the hierarchical relationship between programs and the Strategic Outcome(s) to which they contribute.
results (résultat)
An external consequence attributed, in part, to an organization, policy, program or initiative. Results are not within the control of a single organization, policy, program or initiative; instead they are within the area of the organization’s influence.
statutory expenditures (dépenses législatives)
Expenditures that Parliament has approved through legislation other than appropriation acts. The legislation sets out the purpose of the expenditures and the terms and conditions under which they may be made.
Strategic Outcome (résultat stratégique)
A long term and enduring benefit to Canadians that is linked to the organization’s mandate, vision and core functions.
sunset program (programme temporisé)
A time limited program that does not have an ongoing funding and policy authority. When the program is set to expire, a decision must be made whether to continue the program. In the case of a renewal, the decision specifies the scope, funding level and duration.
target (cible)
A measurable performance or success level that an organization, program or initiative plans to achieve within a specified time period. Targets can be either quantitative or qualitative.
voted expenditures (dépenses votées)
Expenditures that Parliament approves annually through an Appropriation Act. The Vote wording becomes the governing conditions under which these expenditures may be made.
Date modified: