2013-14 Departmental Performance Report (DPR)

This page has been archived on the Web

Information identified as archived is provided for reference, research or recordkeeping purposes. It is not subject to the Government of Canada Web Standards and has not been altered or updated since it was archived. Please contact us to request a format other than those available.

Office of the Privacy Commissioner of Canada

 

(Original signed by)

The Honourable Peter MacKay, P.C., M.P.
Minister of Justice and Attorney General of Canada


Forword

Departmental Performance Reports are part of the Estimates family of documents. Estimates documents support appropriation acts, which specify the amounts and broad purposes for which funds can be spent by the government. The Estimates document family has three parts.

Part I (Government Expenditure Plan) provides an overview of federal spending.

Part II (Main Estimates) lists the financial resources required by individual departments, agencies and Crown corporations for the upcoming fiscal year.

Part III (Departmental Expenditure Plans) consists of two documents. Reports on Plans and Priorities (RPPs) are expenditure plans for each appropriated department and agency (excluding Crown corporations). They describe departmental priorities, strategic outcomes, programs, expected results and associated resource requirements, covering a three-year period beginning with the year indicated in the title of the report. Departmental Performance Reports (DPRs) are individual department and agency accounts of actual performance, for the most recently completed fiscal year, against the plans, priorities and expected results set out in their respective RPPs. DPRs inform parliamentarians and Canadians of the results achieved by government organizations for Canadians.

Additionally, Supplementary Estimates documents present information on spending requirements that were either not sufficiently developed in time for inclusion in the Main Estimates or were subsequently refined to account for developments in particular programs and services.

The financial information in DPRs is drawn directly from authorities presented in the Main Estimates and the planned spending information in RPPs. The financial information in DPRs is also consistent with information in the Public Accounts of Canada. The Public Accounts of Canada include the Government of Canada Consolidated Statement of Financial Position, the Consolidated Statement of Operations and Accumulated Deficit, the Consolidated Statement of Change in Net Debt, and the Consolidated Statement of Cash Flow, as well as details of financial operations segregated by ministerial portfolio for a given fiscal year. For the DPR, two types of financial information are drawn from the Public Accounts of Canada: authorities available for use by an appropriated organization for the fiscal year, and authorities used for that same fiscal year. The latter corresponds to actual spending as presented in the DPR.

The Treasury Board Policy on Management, Resources and Results Structures further strengthens the alignment of the performance information presented in DPRs, other Estimates documents and the Public Accounts of Canada. The policy establishes the Program Alignment Architecture of appropriated organizations as the structure against which financial and non-financial performance information is provided for Estimates and parliamentary reporting. The same reporting structure applies irrespective of whether the organization is reporting in the Main Estimates, the RPP, the DPR or the Public Accounts of Canada.

A number of changes have been made to DPRs for 2013-14 to better support decisions on appropriations. Where applicable, DPRs now provide financial, human resources and performance information in Section II at the lowest level of the organization's Program Alignment Architecture.

In addition, the DPR's format and terminology have been revised to provide greater clarity, consistency and a strengthened emphasis on Estimates and Public Accounts information. As well, departmental reporting on the Federal Sustainable Development Strategy has been consolidated into a new supplementary information table posted on departmental websites. This new table brings together all of the components of the Departmental Sustainable Development Strategy formerly presented in DPRs and on departmental websites, including reporting on the Greening of Government Operations and Strategic Environmental Assessments. Section III of the report provides a link to the new table on the organization's website. Finally, definitions of terminology are now provided in an appendix.

Message from the Privacy Commissioner of Canada

Daniel Therrien

I am pleased to present the Departmental Performance Report of the Office of the Privacy Commissioner of Canada (OPC) for the fiscal year ending March 31, 2014.

I begin my mandate as Commissioner following a pivotal year marked by major transitions for the organization. In addition, the year included significant events illustrating both the pressures exerted on privacy matters and the challenges that the Office faces in reconciling public policy and technological developments.

For example, revelations of state surveillance prompted the Office to call for greater accountability in a special report to Parliament on the activities of the Canadian intelligence community in an era of cyber surveillance.

Further, the investigation concluded by our Office into the loss of an Economic and Social Development Canada hard drive containing personal information on more than 500,000 Canadians is one of many examples demonstrating that formal privacy policies must be applied on a daily basis and monitored regularly.

These examples show how the OPC has continued to promote the further development of privacy legislation to respond to technological and societal changes.

In light of the increasing complexity and volume of privacy complaints and breaches, the OPC has, among other things, implemented efficiencies within its complaint resolution process and thus reduced the average duration of its investigations. It has strengthened its partnering efforts by sharing information and coordinating its investigations with provincial and international counterparts.

In this transition year, the OPC moved into a new headquarters, enabling it to collaborate more effectively with other Agents of Parliament while modernizing its administrative procedures. The OPC also produced a cornerstone document, Privacy Priorities: Reflections on the Office of the Privacy Commissioner of Canada's Strategic Priority Issues, which summarizes the progress achieved since 2008 on its four strategic priority areas and highlights what this means for Canadians. The document also illustrates the excellent work done under the leadership of my predecessors. It is an honour and a privilege for me to take up the torch from them and to continue pursuing a path of protecting privacy rights.

In closing, I find that the Office has embraced a culture of innovation and continuous improvement that is quite in keeping with its mandate and mission. In the current context of limited resources, this gives us the flexibility to continue serving Canadians with excellence and responding to growing demands.

(Original signed by)

Daniel Therrien,
Privacy Commissioner of Canada

Section I: Organizational Expenditure Overview

Organizational Profile

Appropriate MinisterFootnote 1: Peter MacKay

Institutional Head: Daniel Therrien

Ministerial portfolioFootnote 2: Department of Justice Canada

Enabling Instrument(s): Privacy Act, R.S.C. 1985, c. P-21; Personal Information Protection and Electronic Documents Act, S.C. 2000, c.5

Year of Incorporation / Commencement: 1982

Organizational Context

Raison d'être

As an Agent of Parliament, the Privacy Commissioner of Canada reports directly to the House of Commons and the Senate. The mandate of the Office of the Privacy Commissioner of Canada (OPC) is to oversee compliance with both the Privacy Act, which covers the personal information-handling practices of federal government departments and agencies, and the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's private-sector privacy law, along with some aspects of Canada's anti-spam law. The OPC's mission is to protect and promote the privacy rights of individualsFootnote 3.

Responsibilities

The Privacy Commissioner's powers to further the privacy rights of Canadians include:

  • investigating complaints, conducting audits and reviews, and pursuing court action under the Privacy Act and PIPEDA;
  • publicly reporting on the personal information-handling practices of public- and private-sector organizations;
  • supporting, undertaking and publishing research into privacy issues; and
  • promoting public awareness and understanding of privacy issues.

The Commissioner works independently of the government to investigate complaints from individuals with respect to the federal public sector and the private sector. While the focus is on mediation and conciliation, the Commissioner has the power to summon witnesses, administer oaths, and compel the production of evidence. In cases that remain unresolved, and in instances identified in the relevant legislation, the Commissioner may seek an order from the Federal Court to address the situation, if voluntary co-operation does not result.

Strategic Outcome(s) and Program Alignment Architecture

In line with its mandate, the OPC pursues the protection of individuals' privacy rights as its Strategic Outcome. Toward that end, the Office's PAA is composed of three operational programs and one management program as follows:

  1. Strategic Outcome: The privacy rights of individuals are protected
    • 1.1.Program: Compliance Activities
    • 1.2.Program: Research and Policy Development
    • 1.3.Program: Public Outreach

    • Internal Services

Organizational Priorities

In 2013-14, the OPC identified three organizational priorities. The following table presents a summary of the progress made during the reporting period toward achieving each priority. More detailed performance information about accomplishments is provided in Section II - Analysis of Programs by Strategic Outcome.

Priority TypeFootnote 4 Strategic Outcome
1. Continually enhance service to Canadians by integrating process improvements and implementing new legislative authorities Previously committed to This priority is linked to the OPC's single Strategic Outcome: The Privacy rights of individuals are protected.
Summary of Progress

In 2013-14, the OPC improved the efficiency of a number of its processes. For example, the Office:

  • Implemented a calibrated approach and more efficient processes for investigating complaints and reported breaches under the Privacy Act and PIPEDA. This calibrated approach, from the moment a complaint or data breach comes to the OPC's attention until the case is resolved, seeks to capture efficiencies at every stage of the Office's activities, in order to best serve the privacy concerns of Canadians;
  • Launched an initiative to enhance efficiencies and continuous improvements in the delivery of legal services; and
  • Updated the OPC's audit methodology to ensure continued high level of rigor in the Office's audit products and initiated preliminary scoping activities in advance of the risk-based audit planning process slated for 2014-15.

The Office also worked closely with its federal partners, Industry Canada, the Canada Radio-television and Telecommunications Commission (CRTC) and the Competition Bureau, in developing frameworks for investigation protocols and procedures, and ensuring readiness for the coming into force of Canada's Anti-Spam Legislation (CASL) on July 1, 2014.

The Office reinforced its relationships with federal institutions through increased dialogue and the refinement of the departmental portfolio approach previously implemented by the Office. This has allowed the OPC to gain a better understanding of departments' issues and keep pace with an increase in volume and complexity of complaints and reported breaches. To leverage the impact of its own efforts to protect and promote privacy rights, the OPC also continued to build formal and informal ties with provincial and international counterparts.

These efforts increased the overall efficiency and effectiveness of the OPC's operations thus enabling the Office to remain responsive to the needs of Canadians.

More details on results achieved in support of this priority can be found in the Performance Results section under Program 1.1 - Compliance Activities.

 

Priority Type Strategic Outcome
2. Consolidate results achieved in the four priority privacy issues and communicate outcomes to Canadians New This priority is linked to the OPC's single Strategic Outcome: The Privacy rights of individuals are protected.
Summary of Progress

This year the OPC published and disseminated its reflections on the concrete results achieved after five years of focus on the following four priority privacy issues: information technology, public safety, genetic information, and identity integrity and protection. The Office set out how it came to choose these priorities, the impact of our work in these four areas and what we have learned.

Focusing on these priorities has helped the Office get ahead of the curve, strengthen internal capacity, develop strategic work plans and rationalize resources.

More details on results achieved in support of this priority can be found in the Performance Results section under Program 1.2. - Research and Policy Development.

 

Priority Type Strategic Outcome
3. Sustain organizational capacity in light of key transitions and fiscal constraints New This priority is linked to the OPC's single Strategic Outcome: The Privacy rights of individuals are protected.
Summary of Progress

The OPC maintained service excellence during the relocation of its offices to new headquarters. Through active staff engagement and timely response to emerging issues, a Change Management Strategy was a key tool to support employees through this period of transition, with particular emphasis on internal communications.

Work continued to modernize administrative functions in order to optimize resources. The OPC successfully implemented the government-wide Common Human Resource Business Processes within the required timelines. The Office also implemented collaborative services arrangements with other Agents of Parliament, namely for the provision of mailroom services, library and IT user assistance services.

Opportunities to collaborate and share information within the Office were optimized by making full use of collaboration tools and by increasing consultations across the organization.

More details on results achieved in support of this priority can be found in the Performance Results section under Internal Services.

 

Risk Analysis

Key Risks
Risk Risk Response Strategy Link to Program Alignment Architecture

Risk that the OPC not meet expanding expectations.

The demand for OPC privacy advice and expertise is rising as is the complexity of the requests during a time of fiscal restraint. It is important to manage this situation well in order to maintain both the

OPC's credibility and high quality of service for Canadians.

This risk was identified in the 2013-14 RPP.

The OPC continued to improve service delivery and maximized efficiencies through promoting a culture of continuous improvement and integrating best practices from recent changes to other processes throughout the Office. As a result, the Office met or exceeded most of its performance targets across all three of its programs.

The privacy rights of individuals are protected.

Risk that the OPC not be ready to effectively support a change in leadership.

2013-14 marked the end of Commissioner Stoddart's mandate. This change in leadership, the first in 10 years for the OPC, represented an important transition that required well thought-out planning to maintain continuity both in terms of direction within the organization and service to Canadians.

This risk was identified in the 2013-14 RPP.

The Office enhanced internal communications efforts to capture opportunities to support OPC employees throughout this transition. For instance, regular discussions were held between the Interim Commissioner and OPC staff to promote an open dialogue on the priorities and issues of importance to the Office.

The privacy rights of individuals are protected.

Opportunity for the OPC to build greater synergies as part of the relocation to its new headquarters.

The OPC moved its headquarters to state-of-the-art facilities in February 2014. This move represents an opportunity to work more closely with other Agents of Parliament who have offices onsite and to create a work environment more conducive to greater information sharing and collaboration between employees. As a result, this is an opportunity for increased productivity through new found synergies.

This opportunity was identified in the 2013-14 RPP.

In 2013-14, the Office implemented a number of collaborative service arrangements with co-located Agents of Parliament and continued to engage staff through frequent and focussed internal communications and consultations to ensure the new work environment is conducive to synergies and employee well-being. Work will continue in 2014-15 to support employees in leveraging the new work environment, enhancing opportunities for increased collaboration and well-being.

The privacy rights of individuals are protected.

 

Strategic Context and Operating Environment

This year there were a number of significant developments in privacy protection, and for our Office, on many fronts in both the private and public sectors. However, two main drivers continue to shape the OPC's operating environment: technological innovations and evolving public policy.

Technologies are emerging and advancing incredibly quickly, and organizations are often racing to bring innovative new products and services to market without taking time to consider the inherent privacy issues. Technologies such as unmanned aerial vehicles (drones), facial recognition, wearable computing, always-on smart phones, geo-spatial technology, "bring your own device", cloud computing, advanced analytics, and genetic profiling raise significant, novel and complex privacy issues.

The pervasiveness of technologies has privacy implications for many public policy issues. As a result, our Office is increasingly called upon to comment on a broad range of issues, such as public safety measures along the border, governmental surveillance of citizens online, and the need for greater digital literacy among Canadians. To meaningfully engage in these debates, the Office contributes its privacy expertise, and raises awareness and knowledge of broader public policy issues and considerations.

Given the rapid growth and widespread adoption of technology, the OPC's activities, and the nature of the privacy issues faced by organizations, are far more complex and sophisticated than they were in 1983 when the Privacy Act was enacted, or in 2000 when PIPEDA first came into force. For example, recent revelations about national security practices gave us unprecedented insight into the collection and use of personal information by both the private sector and governments. While the privacy implications of these revelations continue to unfold, it has become clear that greater transparency and accountability are needed with respect to the rules that govern the protection of personal information within it.

In addition, privacy issues are not contained within borders or jurisdictions. They often involve a complex array of partners and players. The explosion in the information trade continues to raise complex jurisdictional issues.

Our federal privacy laws are under stress to protect us from potentially highly invasive collection, use and disclosure of personal information by state and corporate actors. The Privacy Act and PIPEDA are both in need of modernization to ensure that they are effective in holding organizations accountable for massive collections and potentially infinite uses of personal information that we see today.

In May 2013, we published a position paper outlining our recommendations on how Canada's private sector law should be modernized to include stronger enforcement powers, mandatory data breach reporting provisions, and increased accountability and transparency. Subsequently, we were encouraged to see some movement towards updating PIPEDA with the introduction of Bill S-4, the Digital Privacy Act. At the time of this report's publication, S-4 included important features such as mandatory breach notification, new penalties and provisions that will make it easier for our Office to ensure that companies carry through on commitments they have made during our investigations. While we welcome these potential improvements in the private-sector law, we cannot forget that our public-sector law, the Privacy Act, has remained untouched in 30 years.

Canada's privacy framework is not the only one under duress. There is recognition internationally that powerful information and communications technologies, coupled with the social and political demands of engaged citizens and consumers, are straining privacy frameworks everywhere. Like Canadians, citizens around the world, are becoming increasingly concerned about the risks of having their personal information lost, stolen or used in unexpected or unwelcome ways.

Actual Expenditures

Budgetary Financial Resources (dollars)

2013-14 Main Estimates 2013-14 Planned Spending 2013-14 Total Authorities Available for Use 2013-14 Actual Spending (authorities used) Difference
(actual minus planned)
29,099,830 29,099,830 30,485,828 28,119,125 (980,705)
The increase between Planned Spending and Total Authorities during 2013—14 represents funding received related to the carry forward, collective agreements and employee benefit plans adjustments.

Human Resources (Full Time Equivalents [FTE])

2013-14 Planned 2013-14 Actual 2013-14
Difference (actual minus planned)
181 177 (4)
As of March 31, 2014, the Office had 177 employees. The variance of 4 full-time equivalents is attributed in part to the delayed staffing of vacant positions and to normal staff turnover.

Budgetary Performance Table for Strategic Outcome(s) and Program(s) (dollars)

Strategic Outcome(s), Program(s) and Internal Services 2013-14 Main Estimates 2013-14 Planned Spending 2014-15 Planned Spending 2015-16 Planned Spending 2013-14 Total Authorities Available for Use 2013-14 Actual Spending (authorities used) 2012-13 Actual Spending (authorities used) 2011-12 Actual Spending (authorities used)
Compliance Activities 11,153,628 11,153,628 11,672,022 11,672,022 12,145,056 11,423,619 11,800,606 11,572,471
Research and Policy Development 4,621,993 4,621,993 3,834,863 3,834,863 3,970,016 2,968,987 4,028,548 3,930,540
Public Outreach 3,152,112 3,152,112 3,096,659 3,096,659 3,222,157 2,698,747 3,500,946 2,985,363
Sub-Total 18,927,733 18,927,733 18,603,544 18,603,544 19,337,229 17,091,353 19,330,100 18,488,374
Internal Services Sub-Total 10,172,097 10,172,097 5,716,909 5,716,909 11,148,599 11,027,772 6,208,756 7,654,492
Total 29,099,830 29,099,830 24,320,453 24,320,453 30,485,828 28,119,125 25,538,856 26,142,866

The OPC overall spending increased from $25.5M in 2012-13 to $28.1M in 2013-14. This increase is mainly due to the one-time funding for the relocation of the OPC headquarters from Ottawa to Gatineau. This relocation was financed by a reverse reprofiling of $4.1M over the next 15 years, starting in 2014-15. OPC relocation costs were for the office set up and equipment as well as the new technology infrastructure.

With the exception of relocation costs, actual expenditures for the OPC's 3 programs decreased by $2.2M in 2013-14 compared to 2012-13. This is largely due to cash-outs of Severance Pay following the renegotiation of collective agreements that took place in 2012-13. The decrease is also due to the OPC's continuous efforts to enhance its internal capacity in resolving investigations under both the Privacy Act and PIPEDA thereby reducing the use of more costly external resources, as well as key positions not being staffed for part of the year.

Alignment of Spending With the Whole-of-Government Framework

Alignment of 2013 Actual Spending with the Whole-of-Government Framework (dollars)

Strategic Outcome Program Spending Area Government of Canada Outcome 2013-14 Actual Spending
1. The privacy rights of individuals are protected 1.1 Compliance Activities Government Affairs A transparent, accountable, and responsive federal government 11,423,619
1.2 Research and Policy Development Government Affairs A transparent, accountable, and responsive federal government 2,968,987
1.3 Public Outreach Government Affairs A transparent, accountable, and responsive federal government 2,698,747

Total Spending by Spending Area (dollars)

Spending Area Total Planned Spending Total Actual Spending
Economic Affairs 0 0
Social Affairs 0 0
International Affairs 0 0
Government Affairs 18,927,733 17,091,353

Departmental Spending Trend

The graph below illustrates the OPC's spending trend over a six-year period. It shows a slight decrease of approximately $0.6M in expenditures over the period of 2011-12 to 2012-13 and an increase of $2.6M from 2012-13 to 2013-14. These fluctuations are mainly due to one-time costs associated cash-outs of severance pay in 2011-12 and 2012-13 and with the relocation of OPC in Gatineau in 2013-14.

The spending trend starting in 2014-15 and ongoing will remain stable at $24.3M and reflects the reductions related to the Deficit Reduction Action Plan resulting from the OPC's efforts to find efficiencies within its operations and use of resources.

Office of the Privacy Commissioner of Canada 2013-14 Spending Trends Graph

Departmental Spending Trend

The departmental spending trend graph illustrates the OPC’s spending trend over a six-year period from 2011-12 to 2016-17. The OPC does not have any sunset program.  The OPC has spent $26.1M in 2011-12, $25.5M in 2012-13 and $28.1M in 2013-14.  The graph shows a slight decrease of approximately $0.6M in expenditures over the period of 2011-12 to 2012-13 and an increase of $2.6M from 2012-13 to 2013-14.  These fluctuations are mainly due to one-time costs associated cash-outs of severance pay in 2011-12 and 2012-13 and with the relocation of OPC in Gatineau in 2013-14.

The spending trend starting in 2014-15 and ongoing will remain stable at $24.3M and reflects the reductions related to the Deficit Reduction Action Plan resulting from the OPC’s efforts to find efficiencies within its operations and use of resources.

Estimates by Vote

For information on the Office of the Privacy Commissioner of Canada's Votes and statutory expenditures, consult the Public Accounts of Canada 2014 on the Public Works and Government Services Canada Website. An electronic version of the Public Accounts 2013 is available on the Public Works and Government Services Canada's website.

Section II: Analysis of Program(s) by Strategic Outcome(s)

Strategic Outcome: The privacy rights of individuals are protected

All OPC efforts and activities are directed towards achieving the organization's single Strategic Outcome, the protection of individuals' privacy rights. The Office plays a leadership role in encouraging organizations that handle Canadians' personal information to respect individuals' privacy rights. Others who contribute to this mission include provincial and territorial privacy commissioners, data-protection authorities around the world, privacy advocacy groups, chief privacy officers, professional associations, consumer representatives, civil society, academics, Parliamentary committees, and federal departments and agencies.

Program 1.1: Compliance Activities

DescriptionFootnote 5

A selection of credit cards and a computer keyboard being used for online purchases.

The OPC is responsible for investigating privacy-related complaints and responding to inquiries from individuals and organizations. Through audits and reviews, the OPC also assesses how well organizations are complying with requirements set out in the two federal privacy laws, and provides recommendations on Privacy Impact Assessments (PIAs), pursuant to Treasury Board policy. This activity is supported by a legal team that provides specialized advice and litigation support, and a research team with senior technical and risk-assessment support.

Budgetary Financial Resources (dollars)

2013-14 Main Estimates 2013-14 Planned Spending 2013-14 Total Authorities Available for Use 2013-14 Actual Spending (authorities used) Difference (actual minus planned)
11,153,628 11,153,628 12,145,056 11,423,619 269,991
The actual spending includes reallocations between activities to better reflect Program spending.

Human Resources (FTEs)

2013-14 Planned 2013-14 Actual 2013-14
Difference (actual minus planned)
81 90 9

Performance Results

Expected Results Performance Indicators Targets Actual Results
Intermediate Outcome
1. Federal government institutions and private-sector organizations meet their obligations under federal privacy legislation and implement modern practices of personal information protection. 1.1 Percentage of investigation recommendations implemented within set timelinesFootnote 6 90 percent 90 percent
1.2 Percentage of audit recommendations fully implemented two years after publication of the final audit reportFootnote 7 75 percent 72 percent
Intermediate Outcomes
2. Individuals receive responses to their information requests and complaints. 2.1 Percentage of information requests responded to within established service standards 90 percent 97 percent
2.2 Percentage of complaints resolved through early-resolution strategies, where no formal investigation is commenced 20 percent 29 percent
2.3 Percentage of complaints responded to within 12 months of acceptanceFootnote 8 95 percent 87 percent
3. Federal government institutions and private-sector organizations receive advice and recommendations to improve their privacy practices, in compliance with federal privacy legislation and policies. 3.1 Percentage of PIA consultations/ recommendations that result in an added privacy protection for government programs/initiatives 75 percent 90 percent
3.2 Percentage of audits completed within planned timelines 90 percent 100 percent

For indicator 1.2, in addition to the 72 percent of audit recommendations fully implemented, the audited entities indicated that the remaining recommendations have been substantially implemented.

With respect to indicator 2.3, the 87 percent of complaints responded to within 12 months excludes a Commissioner-initiated investigation into the loss of a hard drive by Employment and Social Development Canada (ESDC). This single incident generated a high volume of individual complaints (871), which, if included, would affect our overall performance for cases completed within the year.

Regarding indicator 3.1, the OPC received 29 responses to recommendations made after reviewing PIAs and providing advice during consultations on initiatives which had privacy implications. Twenty-six of these responses indicate that privacy protective measures have been or will be implemented by the institution in response to our recommendations. Some of the initiatives for which we received responses in 2013-14 were reviewed in previous fiscal years.

Performance Analysis and Lessons Learned

The OPC continued to see an increase in the complexity and volume of new complaints and breaches. The Office saw an increase of 17 percent in complaints both under PIPEDA and the Privacy Act. The Office was also faced with a growing number of data breach reports from both private sector organizations (81 percent increase) and federal organizations (a 109 percent increase).

To remain responsive and effectively protect the privacy rights of Canadians, the Office improved its investigative processes in many ways: by maximizing the use of early resolution (a simplified and expedient form of investigation), developing new and enhancing existing investigative tools, adopting a calibrated approach to respond to breach notifications and investigations, providing more focused training for employees and, in the case of investigations under PIPEDA, extending the use of the discontinuance provisions of that legislation (e.g. the discontinuance of multiple related complaints with one Commissioner initiated complaint).

These measures ensured that resources were allocated in the most efficient manner to address the privacy issues that pose the greatest risk to Canadians. They resulted in a decrease in the average complaint response time for PIPEDA investigations from 8.3 months to 5.3 months and from 6.7 months to 6.6 months for Privacy Act investigations (excluding 871 ESDC breach related complaints).

The OPC continued to build formal and informal ties with provincial and international counterparts in order to leverage the impact of its own efforts to protect and promote privacy rights. Such joint approaches included: addressing the issue of Privacy Practice Transparency through the Global Privacy Sweep; successfully collaborating with domestic and international partners on a data breach; and, proceeding with information sharing and/or coordinated investigations with international Data Protection Authorities (DPA) (e.g. the Irish DPA and the Federal Trade Commission).

The Office also enhanced services provided by its Information Centre to Canadians and organizations by further improving the quality and timeliness of responses to close to 10,000 questions it receives per year. The quality assurance program put in place works to ensure the information provided is complete and accurate. As well, new service standards have been implemented and have since been met consistently. A customer satisfaction survey conducted in 2013-14 suggested the service provided by the Information Centre met or exceeded the expectations of 96 percent of respondents.

Program 1.2: Research and Policy Development

DescriptionFootnote 9

A person using an eye scan and fingerprint recognition system.

The OPC serves as a centre of expertise on emerging privacy issues in Canada and abroad by researching trends and technological developments, monitoring legislative and regulatory initiatives, providing legal, policy and technical analyses on key issues, and developing policy positions that advance the protection of privacy rights. An important part of the work involves supporting the Commissioner and senior officials in providing advice to Parliament on potential privacy implications of proposed legislation, government programs, and private-sector initiatives.

Budgetary Financial Resources (dollars)

2013-14 Main Estimates 2013-14 Planned Spending 2013-14 Total Authorities Available for Use 2013-14 Actual Spending (authorities used) Difference (actual minus planned)
4,621,993 4,621,993 3,970,016 2,968,987 (1,653,006)
The actual spending includes reallocations between activities to better reflect Program spending.

Human Resources (FTEs)

2013-14 Planned 2013-14 Actual 2013-14
Difference (actual minus planned)
29 20 (9)

Performance Results

Expected Results Performance Indicators Targets Actual Results
Intermediate Outcome
1. Public- and private-sector stakeholders are enabled to develop policies and initiatives that respect privacy rights. 1.1 Percentage of positive feedback from stakeholders about the usefulness of OPC policy guidance Footnote 10 70 percent 75 percent
Intermediate Outcomes
2. Parliamentarians are able to draw on OPC expertise to identify and address privacy issues. 2.1 Percentage of bills and issues with a high or medium relevance to privacy that receive the OPC's views in the course of the legislative processFootnote 11 75 percent 100 percent
3. Knowledge about privacy issues is advanced. 3.1 Increased take-up of OPC research Annual increase relative to previous year 7,632 visits (baseline year)

For indicator 1.1, the OPC's survey of Businesses found that 41 percent of the 1,006 surveyed businesses were aware that the OPC has information, guidance and tools available to companies to help them comply with their privacy obligations. Among those who were aware, 17 percent have used the resources. Of those who used them, 75 percent rated them as useful.

Regarding indicator 3.1, there were 6,607 visits to the English Index page and 1,025 visits to the French Index page for the Research section of the OPC website from April 1, 2013 to March 31, 2014.

Performance Analysis and Lessons Learned

The Office provided advice and information to Parliamentarians and Canadians with respect to proposed legislation and participated in various domestic and international fora on a broad range of issues such as accountability, cybersecurity, big data, genetic information, and internet and privacy. It continued to build knowledge about emerging and systemic privacy issues to inform all aspects of OPC advice and guidance.

In January 2014, the OPC tabled a Special Report to Parliament on reinforcing privacy protection and oversight for the Canadian intelligence community in an era of cyber-surveillance. The report's recommendations were built upon consultations with a range of experts and civil society representatives and the aim of the report was to contribute to a public discussion on these important issues.

The Office also worked in consultation with its counterparts across Canada to launch guidance around the sharing of personal information in an emergency situation; provided a submission to the Department of Finance Canada on Canada's financial consumer protection framework; published guidance on managing family member/household accounts as well as a privacy toolkit for businesses and organizations; and issued two additional Interpretation Bulletins on key legal terms in PIPEDA.

The end of former Privacy Commissioner Jennifer Stoddart's mandate provided an occasion to highlight how privacy protection evolved during her term. The Office produced and made public a report on the results achieved by the Office in the four privacy areas that served as the focus of OPC's activities since 2008 entitled Reflections on the Office of the Privacy Commissioner of Canada's Strategic Priority Issues (October 2013).

The Office completed and published research papers on "Drones", "Facial Recognition" and "What an IP Address Can Reveal About You."

The Office continued to implement the strategy aimed at maximizing the value and relevance of its Contributions Program and for disseminating research results to stakeholders and the public. For instance the OPC increased visibility of the projects funded by the Program by awarding funding to an external group to organize and host the second Pathways to Privacy Research Symposium in March 2014. Over 125 participants representing a variety of interests, including academia, government, non-profit organizations, and privacy professionals, attended the full-day event and provided very positive feedback on this event.

Knowledge gained through public opinion research and other types of research supported the development of guidance documents for small- and medium-sized enterprises to assist them in meeting their obligations and fostering public trust. Based on feedback received from the privacy community, the OPC posted an increased number of findings and summaries of findings, resources which provide organizations with valuable information for compliance with PIPEDA. The Office also searched over 300 sites during the first annual Global Privacy Enforcement Network (GPEN) Internet Privacy Sweep; the publication of results highlighted the importance for organizations to be open and transparent about their privacy practices.

The Office increased the capacity of the Technology Laboratory through the installation of equipment, and the development of procedures and processes in support of all research and investigative activities performed in the Technology Laboratory. The Laboratory's capacity will continue to evolve to meet the needs of the Office and to position the Office to meet its responsibilities when Canada's anti-spam legislation fully comes into force.

Program 1.3: Public Outreach

DescriptionFootnote 12

A person using PIN-pad at a bank machine.

The OPC delivers public education and communications activities, including speaking engagements and special events, media relations, and the production and distribution of promotional and educational material. Through public outreach activities, individuals are informed about privacy and personal data protection, enabling them to protect themselves and exercise their rights. The activities also allow organizations to understand their obligations under federal privacy legislation.

Budgetary Financial Resources (dollars)

2013-14 Main Estimates 2013-14 Planned Spending 2013-14 Total Authorities Available for Use 2013-14 Actual Spending (authorities used) Difference (actual minus planned)
3,152,112 3,152,112 3,222,157 2,698,747 (453,365)
The actual spending includes reallocations between activities to better reflect Program spending.

Human Resources (FTEs)

2013-14 Planned 2013-14 Actual 2013-14
Difference (actual minus planned)
21 15 (6)

Performance Results

Expected Results Performance Indicators Targets Actual Results
Intermediate Outcome
1. Federal government institutions and private-sector organizations better understand their obligations under federal privacy legislation and individuals better understand their rights. 1.1 Percentage of participants in the annual OPC Privacy Impact Assessment (PIA) workshop who feel they acquired a better understanding of the requirement to assess privacy risks of federal programs 75 percent 100 percent
1.2 Percentage of private-sector organizations that are moderately or highly aware of their obligations under federal privacy legislation 85 percent by March 31, 2014 87 percent
1.3 Percentage of Canadians who feel they know about their privacy rights 20 percent
by March 31, 2015
Biennial survey — next survey in 2014-15
Intermediate Outcomes
2. Individuals have access to relevant and timely information to protect their privacy rights. 2.1 Annual increase in website visits Visits to OPC websites increase year over year 15 percent decrease
3. Federal government institutions and private-sector organizations have access to useful information about their privacy responsibilities. 3.1 New channels or approaches for communicating privacy information and guidance each year At least 3 5

For indicator 1.3, the OPC surveys Canadians every two years to explore awareness, understanding and perceptions of privacy-related issues. The next survey will occur in 2014-15 and the results will be communicated in the 2014-15 Departmental Performance Report.

With respect to indicator 2.1, figures show that visits decreased by 15 percent in contrast with previous figures reported. However, this is following a technical adjustment designed to no longer take into account visits by Web robots, which, following a search optimization study, were estimated as representing 20 percent of visits. Given this, we estimate that we actually experienced approximately 5 percent in increase to web traffic over the previous fiscal year.

Performance Analysis and Lessons Learned

The OPC continued to respond to a growing demand for information on privacy protection as Canadians' interest was spurred by specific events and developing trends affecting their personal information or their organization's responsibility.

The Office accommodated significantly (40 percent) more media requests than the previous year; issues of interest included the OPC's Special Report to Parliament on intelligence oversight, the investigation into the loss of a hard drive at ESDC, the OPC's position paper on PIPEDA reform, and a PIPEDA annual report focused on online reputation. These and many other issues and initiatives drove the demand for OPC officials to deliver (25 percent) more speeches. Some of this interest was also linked to the conclusion of former commissioner Jennifer Stoddart's term. Many media and other stakeholders expressed an interest in hearing her perspective and insights at the conclusion of her 10-year mandate.

In order to meet the ever increasing interest for privacy issues, the Office made additional efforts to make its information more accessible to Canadians and to organizations subject to the Privacy Act and to PIPEDA.

  • New channels and approaches were used such as creating a number of e-books to access key publications, creating infographics to visually promote our online resources and information, and updating and modernizing some of our key publications.
  • The OPC continued to be present in social media with blog posts on privacy themes in pop culture and infographics on the results of our public opinion survey of Canadians. These posts encourage Canadians to think about privacy as a recurring theme in daily life. Our presence on Twitter increased by 30% to nearly 8000 followers.

The OPC's efforts at reaching specific segments of the population included the development of new products such as a Discussion Guide for Teachers and Activity Sheets for younger children. The Office reached key stakeholders in academia and research with Real Results, a publication featuring the outcome of research projects funded by the Contributions Program. The OPC promoted robust PIPEDA compliance on a national scale, with a focus on small- and medium-sized enterprises and specific efforts on priority industry sectors such as travel/tourism and restaurant/hospitality.

The OPC also made specific efforts at maximizing its resources and sustain its capacity in light of fiscal constraints. Making more documents readily available online helped reduce printing and shipping costs; more than 100,000 downloads were observed of Social Smarts, an educational graphic novel targeting youth. The significant number of downloads was due in part to promotional efforts aimed at showcasing the graphic novel as a useful classroom tool for educators and librarians. Closer collaboration with the Information Centre helped improve the quality of the information shared with callers; analysis of the issues raised by callers helped enhance the quality and relevance of information posted on the OPC website.

The Office changed the focus of its PIA outreach work for 2013-14 to offer smaller, more collaborative sessions tailored to the knowledge level of participants. The OPC held three outreach sessions which covered introductory guidance on how to assess privacy risks. As well, the Office provided guidance to assess IT related privacy risks. Going forward the intention is to provide more frequent information sessions to assist federal entities ensure that privacy risks are identified and that mitigation measures are put in place as part of the Privacy Impact Assessment process.

During this last year, the OPC has successfully faced the challenge of meeting Canadians' need for more information while making a careful use of limited resources. In doing so, the Office has efficiently contributed to the protection of their privacy rights.

Internal Services

DescriptionFootnote 13

Internal Services are groups of related activities and resources that support the needs of programs and other corporate obligations of an organization. As a small entity, the OPC's internal services include two sub-programs: governance and management support, and resource management services (which also incorporate asset management services). Communications services are not included in Internal Services but rather form part of Program 3 - Public Outreach. Similarly, legal services are not included in Internal Services at OPC, but are covered under Program 1 - Compliance Activities, and Program 2 - Research and Policy Development.

Budgetary Financial Resources (dollars)

2013-14 Main Estimates 2013-14 Planned Spending 2013-14 Total Authorities Available for Use 2013-14 Actual Spending (authorities used) Difference (actual minus planned)
10,172,097 10,172,097 11,148,599 11,027,772 855,675
The actual spending includes reallocations between activities to better reflect Program spending.

Human Resources (FTEs)

2013-14 Planned 2013-14 Actual 2013-14
Difference (actual minus planned)
50 52 2

Performance Results

Expected Results Performance Indicators Targets Actual Results
The OPC achieves a standard of organizational excellence, and managers and staff apply sound business management practices. Percentage of the Management Accountability Framework (MAF) areas rated strong or acceptable Footnote 14 70 percent by March 31, 2015 The OPC conducts a self-assessment biennially. The next self-assessment is planned for 2014-15 and the results will be communicated in the OPC's Departmental Performance Report for that year.

Performance Analysis and Lessons Learned

The OPC continued to strive towards organizational excellence and promoted sound business management practices throughout the year.

This year the OPC's headquarter offices moved to new modern facilities. The Office incorporated effective change management strategies to support employees throughout this move, focusing on internal consultations and communications. Work continues in 2014-15 to support OPC employees as they adapt to their new work environment and to ensure they are well-equipped to provide a high level of service to Canadians.

The Office continued to identify opportunities for collaborative services with other Agents of Parliament with a view to generate efficiencies, reduce operational risks and/or improve services. A number of collaborative services were established, including the consolidation of mailrooms with co-tenants, a shared library with the Office of the Commissioner of Official Languages (OCOL) and Elections Canada, and a shared interview room to conduct investigations and shared space for the provision of IT users assistance services with OCOL.

The Office also actively participated in government-wide common processes and systems initiatives. The Office implemented the Common HR Business Process (CHRBP) to improve an enterprise-wide approach to HR management practices. In response to the government wide initiative to configure a single instance of PeopleSoft©, through its participation in the Human Resource Information System (HRIS) Cluster, the OPC was a key lead in the replacement project of the HRIS for Small Departments and Agencies.

The OPC also modernized its internal controls for the Contributions Program and conducted four funding recipient audits. A recipient audit is an independent assessment of compliance with a funding agreement. The audits concluded that the recipients diligently managed and expended the funds allocated to their project, as per the terms of their agreement with us.

The Office optimized the use of existing and new fora and tools to coordinate internal activities and share information. To enhance knowledge of the OPC's internal research work and the research funded under the Contributions Program, the Office held 12 sessions for OPC staff under the Privacy Conversations banner on subjects such as online surveillance, digital activism, drones, facial recognition as well as updates on Canadian and US privacy law developments. To better coordinate internal activities, and manage risks, the OPC also created an internal horizontal integration forum that meets weekly with representatives from all operational branches. In addition, the Office implemented its new electronic document management system, Officium.

To remain responsive to Canadians, the Office will continue to promote a culture of continuous improvement and innovation in its service delivery, reviewing its processes and its organizational structure on an ongoing basis. This will ensure that the Office has the flexibility and nimbleness to continue serving Canadians with excellence in the face of growing demands and limited resources.

Section III: Supplementary Information

The financial highlights presented in this section are drawn from the OPC's financial statements and have been prepared using Government of Canada accounting policies, which are based on Canadian public sector accounting standards.

Financial Statements Highlights

Office of the Privacy Commissioner of Canada
Condensed Statement of Operations and Net Financial Position
For the Year Ended March 31, 2014
(dollars)
  2013-14
Planned Results
2013-14
Actual
2012-13
Actual
Difference
(2013-14 actual minus 2013-14 planned)
Difference
(2013-14 actual minus 2012-13 actual)
Total Expenses 30,114,985 28,989,407 28,113,561 (1,125,578) 875,846
Net cost of operations before government funding and transfers 30,114,985 28,989,407 28,113,561 (1,125,578) 875,846
Net financial position 1,414,000 1,565,349 (324,847) 151,349 1,890,196

Condensed Statement of Financial Position

Office of the Privacy Commissioner of Canada
Condensed Statement of Financial Position
For the Year Ended March 31, 2014
(dollars)
  2013-14 2013-14 Difference
(2013-14 minus 2012-13)
Total net liabilities 4,594,469 4,621,445 (26,976)
Total net financial assets 2,546,412 2,699,722 (153,310)
Net debt 2,048,057 1,921,723 126,334
Total non-financial assets 3,613,406 1,596,876 2,016,530
Net financial position 1,565,349 (324,847) 1,890,196

Assets by Type

Assets by Type

This graph illustrates the total assets for the OPC. Total assets were $6,160K at the end of 2013-14, an increase of $1,863K (43 percent) over the previous year's total assets of $4,297K. Of the total assets, the Consolidated Revenue Fund totalled $2,361K (38 percent) while $3,469K (57 percent) represented Tangible Capital Assets. Accounts Receivable and Advances and Prepaid Expenses accounted for 3 percent and 2 percent of total assets, respectively.

Total assets were $6,160K at the end of 2013-14, an increase of $1,863K (43 percent) over the previous year's total assets of $4,297K. Of the total assets, the Consolidated Revenue Fund totalled $2,361K (38 percent) while $3,469K (57 percent) represented Tangible Capital Assets. Accounts Receivable and Advances and Prepaid Expenses accounted for 3 percent and 2 percent of total assets, respectively.

Liabilities by Type

Liabilities by Type

This graph illustrates the total liabilities for the OPC.  Total liabilities were $4,595K at the end of 2013-14, a decrease of $27K (0.6 percent) over the previous year’s total liabilities of $4,622K. Accounts Payable/Accrued Liabilities represented the largest portion of the total liabilities, at $2,145K, or 47 percent. Employee Severance Benefits represented a smaller portion of liabilities, at $1,131K, or 25 percent of the total. Vacation pay and Compensatory Pay, and Accrued Employee Salaries accounted for 19 percent and 9 percent of total liabilities, respectively.

Total liabilities were $4,595K at the end of 2013-14, a decrease of $27K (0.6 percent) over the previous year's total liabilities of $4,622K. Accounts Payable/Accrued Liabilities represented the largest portion of the total liabilities, at $2,145K, or 47 percent. Employee Severance Benefits represented a smaller portion of liabilities, at $1,131K, or 25 percent of the total. Vacation pay and Compensatory Pay, and Accrued Employee Salaries accounted for 19 percent and 9 percent of total liabilities, respectively.

Expenses - Where Funds Go

Expenses - Where Funds Go

This graph illustrates the total expenses for OPC.  Total expenses for the OPC were $28,990K in 2013-14.The largest share of the funds, $13,370K, or 46 percent, was spent on Compliance Activities, while Internal Services accounted for 32 percent of the total. Research and policy development represented $3,407K, or 12 percent, of total expenses. Public Outreach efforts represented $3,043K of the expenditures, or 10 percent of the total. (Note that expenses by program activity might differ from those identified in the Public Accounts of Canada due to the methodology used to prorate the allocation in the financial statements as well as the inclusion of related party transactions.)

Total expenses for the OPC were $28,990K in 2013-14.The largest share of the funds, $13,370K, or 46 percent, was spent on Compliance Activities, while Internal Services accounted for 32 percent of the total. Research and policy development represented $3,407K, or 12 percent, of total expenses. Public Outreach efforts represented $3,043K of the expenditures, or 10 percent of the total. (Note that expenses by program activity might differ from those identified in the Public Accounts of Canada due to the methodology used to prorate the allocation in the financial statements as well as the inclusion of related party transactions.)

Financial Statements

Information on OPC's audited financial statements can be found on its website.

Supplementary Information Tables

The supplementary information table listed below can be found on the OPC's website:

  • Internal Audits and Evaluations.

Tax Expenditures and Evaluation Report

The tax system can be used to achieve public policy objectives through the application of special measures such as low tax rates, exemptions, deductions, deferrals and credits. The Department of Finance Canada publishes cost estimates and projections for these measures annually in the Tax Expenditures and Evaluations publication. The tax measures presented in the Tax Expenditures and Evaluations publication are the sole responsibility of the Minister of Finance.

Section IV: Organizational Contact Information

30 Victoria Street, 1st Floor
Gatineau, Quebec K1A 1H3
Canada

Telephone: 819-994-5444
Toll Free: 1-800-282-1376
Fax: 819-994-5424
TTY: 819-994-6591
Website: www.priv.gc.ca

Appendix: Definitions

appropriation: Any authority of Parliament to pay money out of the Consolidated Revenue Fund.

budgetary expenditures: Include operating and capital expenditures; transfer payments to other levels of government, organizations or individuals; and payments to Crown corporations.

Departmental Performance Report: Reports on an appropriated organization's actual accomplishments against the plans, priorities and expected results set out in the corresponding Reports on Plans and Priorities. These reports are tabled in Parliament in the fall.

full-time equivalent: Is a measure of the extent to which an employee represents a full person-year charge against a departmental budget. Full-time equivalents are calculated as a ratio of assigned hours of work to scheduled hours of work. Scheduled hours of work are set out in collective agreements.

Government of Canada outcomes: A set of 16 high-level objectives defined for the government as a whole, grouped in four spending areas: economic affairs, social affairs, international affairs and government affairs.

Management, Resources and Results Structure: A comprehensive framework that consists of an organization's inventory of programs, resources, results, performance indicators and governance information. Programs and results are depicted in their hierarchical relationship to each other and to the Strategic Outcome(s) to which they contribute. The Management, Resources and Results Structure is developed from the Program Alignment Architecture.

non-budgetary expenditures: Include net outlays and receipts related to loans, investments and advances, which change the composition of the financial assets of the Government of Canada.

performance: What an organization did with its resources to achieve its results, how well those results compare to what the organization intended to achieve and how well lessons learned have been identified.

performance indicator: A qualitative or quantitative means of measuring an output or outcome, with the intention of gauging the performance of an organization, program, policy or initiative respecting expected results.

performance reporting: The process of communicating evidence-based performance information. Performance reporting supports decision making, accountability and transparency.

planned spending: For Reports on Plans and Priorities (RPPs) and Departmental Performance Reports (DPRs), planned spending refers to those amounts that receive Treasury Board approval by February 1. Therefore, planned spending may include amounts incremental to planned expenditures presented in the Main Estimates.

A department is expected to be aware of the authorities that it has sought and received. The determination of planned spending is a departmental responsibility, and departments must be able to defend the expenditure and accrual numbers presented in their RPPs and DPRs.

plans: The articulation of strategic choices, which provides information on how an organization intends to achieve its priorities and associated results. Generally a plan will explain the logic behind the strategies chosen and tend to focus on actions that lead up to the expected result.

priorities: Plans or projects that an organization has chosen to focus and report on during the planning period. Priorities represent the things that are most important or what must be done first to support the achievement of the desired Strategic Outcome(s).

program: A group of related resource inputs and activities that are managed to meet specific needs and to achieve intended results and that are treated as a budgetary unit.

results: An external consequence attributed, in part, to an organization, policy, program or initiative. Results are not within the control of a single organization, policy, program or initiative; instead they are within the area of the organization's influence.

Program Alignment Architecture: A structured inventory of an organization's programs depicting the hierarchical relationship between programs and the Strategic Outcome(s) to which they contribute.

Report on Plans and Priorities: Provides information on the plans and expected performance of appropriated organizations over a three-year period. These reports are tabled in Parliament each spring.

Strategic Outcome: A long-term and enduring benefit to Canadians that is linked to the organization's mandate, vision and core functions.

sunset program: A time-limited program that does not have an ongoing funding and policy authority. When the program is set to expire, a decision must be made whether to continue the program. In the case of a renewal, the decision specifies the scope, funding level and duration.

target: A measurable performance or success level that an organization, program or initiative plans to achieve within a specified time period. Targets can be either quantitative or qualitative.

whole-of-government framework: Maps the financial contributions of federal organizations receiving appropriations by aligning their Programs to a set of 16 government-wide, high-level outcome areas, grouped under four spending areas.

Endnotes

Date modified: