Vision, mission, raison d’être and operating context – 2026-27 Departmental Plan

Vision, mission, raison d’être

As an agent of Parliament, the Privacy Commissioner of Canada reports directly to the House of Commons and the Senate. The mandate of the Office of the Privacy Commissioner of Canada (OPC) is to oversee compliance with both the Privacy Act, which covers the personal information-handling practices of federal government institutions, and the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s federal private sector privacy law, along with some aspects of Canada’s anti-spam legislation (CASL). The OPC’s mission is to protect and promote the privacy rights of individuals.^Footnote1

The Privacy Commissioner’s powers to further the privacy rights of Canadians include:

• investigating complaints, conducting audits and pursuing court action under the authority of the Privacy Act and PIPEDA;
• publicly reporting on the personal information-handling practices of public and private sector organizations;
• supporting, undertaking and publishing research into privacy issues; and
• promoting public awareness and understanding of privacy issues, including appearing before Parliament on proposed legislation and studies on issues affecting the privacy rights of Canadians.

The Commissioner works independently of government to investigate federal public sector-related complaints from individuals under the Privacy Act, and complaints related to the private sector under PIPEDA. He also has some designated responsibilities to ensure compliance with CASL.

The Commissioner may address complaints through mediation and conciliation; he also has the power to summon witnesses, administer oaths, and compel the production of evidence. In cases where the investigation does not result in a voluntary agreement/resolution and remains unresolved, the Commissioner may seek an order from the Federal Court to address the situation under certain circumstances.

Operating context

The Office of the Privacy Commissioner of Canada (OPC) operates in a constantly evolving environment that is shaped by technological innovation. Although emerging technologies create new opportunities to connect and to innovate, they also introduce significant risks to privacy.

Protecting privacy has become one of the paramount challenges of our time. The evolution of technology, combined with the breadth and scope of the OPC’s mandate, adds considerable complexity to its work. Mass data collection, automated decision making, and profiling are becoming increasingly central to economic activity, but they carry immense implications for privacy and, by extension, for fundamental rights and freedoms.

Privacy is a global issue that cannot be dealt with by one country alone. Canada must play a larger leadership role and develop strong relationships with countries all around the world. Last fall, the Privacy Commissioner was elected Chair of the Global Privacy Assembly (GPA). This GPA role gives Canada and the OPC a unique opportunity to shape the future of global data protection.

In this shifting landscape, data breaches continue to be a significant concern. It is essential that public institutions and private organizations both prioritize information security, as there can be serious consequences for individuals whose personal information is impacted by a privacy breach.

From an operational perspective, certain developments are increasing the volume and complexity of the OPC’s workload. Advances, like AI-enabled search technology can enhance individuals’ awareness of their privacy rights. The number of privacy complaints made to the OPC has been increasing substantially, and almost doubled last year compared to the average number of complaints made in the two previous fiscal years. This includes an increase in the number of complaints related to the Privacy Act Extension Order, No. 3, which allows foreign nationals request access to their personal information held by government departments.

Furthermore, the temporary funding, that enabled the OPC to reduce investigative backlogs, to conduct investigations into complex emerging technologies and novel business practices, and to carry out an in-depth review of a larger number of the breaches reported to it has come to an end.

Another challenge putting pressure on the OPC resources is its new responsibility for reviewing and approving codes of practice under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA). The OPC is required to review and approve codes it receives within legislated timelines; however, no additional funding was provided to meet this new mandate obligation.

With volumes and mandate obligations continuing to grow, the OPC is entering a challenging period in which it must manage increasing demands with limited resources. This challenging operating context highlights the need for efficiencies, reform, and resources.

A necessary precondition to establishing trust in the digital economy is a privacy regulator with enough capacity and the right tools to respond to the privacy challenges of the 21st century. Last fall, the OPC welcomed the comments from the Minister of Artificial Intelligence and Digital Innovation and Minister responsible for the Federal Economic Development Agency for Southern Ontario on the government’s plans to introduce modernized public- and private-sector privacy laws that recognize the realities of today’s digital economy.

Over the next year, the OPC will prioritize efforts in areas where it can have the greatest impact on Canadians and where there are the greatest risks if they are not addressed. Central to this work will be advancing its strategic priorities, maximizing the OPC’s impact, addressing the privacy implications of technologies like artificial intelligence (AI), and championing children’s privacy.

To achieve these goals, domestic and international collaboration will remain essential for sharing knowledge and expertise, jointly examining emerging issues, and working together to advance common standards to provide better privacy protection for individuals and greater consistency among organizations operating across jurisdictions.

To remain resilient and fulfill its core mandate, the OPC will continue to build on its ongoing transformation and review of internal structures and resources, and to streamline processes and enhance efficiency. It will also optimize operations, amplify results, and deliver services to Canadians with the highest possible effectiveness.

Building on innovation, the OPC will also continue advancing its AI strategy to strengthen its own analytical and operational capacity, while contributing to the broader dialogue on the ethical, transparent, and responsible use of AI in regulatory environments. In so doing, the OPC will demonstrate that innovation and privacy protection can—and must—go hand in hand.

---