Office of the Privacy Commissioner of Canada’s 2024–25 Departmental results report

Results – what we achieved

Core responsibilities and internal services

• Core responsibility 1: Protection of Privacy Rights
• Internal services

Core responsibility 1: Protection of Privacy Rights

Progress on results

This section details the OPC’s performance against its targets for each departmental result under Core responsibility 1: Protection of Privacy Rights.

Table 1: Privacy rights are respected and obligations are met

Table 1 shows the target, the date to achieve the target and the actual result for each indicator under Privacy rights are respected and obligations are met in the last three fiscal years.

Table 2: Canadians are empowered to exercise their privacy rights

Table 2 shows the target, the date to achieve the target and actual result for each indicator under Canadians are empowered to exercise their privacy rights in the last three fiscal years.

Table 3: Parliamentarians, and public and private sector organizations are informed and guided to protect Canadians’ privacy rights

Table 3 shows the target, the date to achieve the target and actual result for each indicator under Parliamentarians, and public and private sector organizations are informed and guided to protect Canadians’ privacy rights in the last three fiscal years.

The Results section of the Infographic for OPC’s on GC Infobase page provides additional information on results and performance related to its program inventory.

Details on results

The following section describes the results for the Protection of Privacy Rights in 2024–25 compared with the planned results set out in the OPC’s departmental plan for the year.

In 2024–25, the OPC focused its efforts on advancing its strategic priorities as outlined in its multi‑year strategic plan to have the greatest impact and contribute to its three departmental results:

Result 1: Privacy rights are respected and obligations are met

Results achieved

The OPC remained committed to providing Canadians with a strong, fair, accessible, and timely compliance process, while taking action to improve the protection of Canadians’ personal information and deliver results that make a real difference in their lives. As part of these efforts, the OPC:

• Conducted an internal strategic review, resulting in a major reorganization and transformation which will allow the OPC to respond more rapidly and effectively to emerging issues; broaden its approach to compliance; and bring stronger alignment to its policy and legal work, as well as its enforcement and advisory activities. The full transformation will take effect in 2025–26.
• Leveraged temporary funding received for 2024–25 to adequately respond to privacy breaches reported by public and private sector organizations, and to investigate privacy complaints from the public in a timely manner.
  • Although the OPC did not reach its 75% target of complaints responded to within its service standards, it nonetheless improved this result over the previous two years (62% in 2024–25 compared to 50% in 2023–24, and 55% in 2022–23). It also made significant progress at reducing its ongoing overall investigative backlog from 24% to 9% over two years.
  • Launched an investigation into Ticketmaster following a cybersecurity incident that affected the accounts of millions of people worldwide, launched an investigation into cyberattacks at the Canada Revenue Agency that led to more than 30,000 privacy breaches dating back to 2020, and opened a joint investigation with the United Kingdom privacy authority into a data breach at global direct-to-consumer genetic testing company 23andMe.
  • Advanced major investigations into a number of matters, including TikTok and OpenAI.
  • Launched an online breach-reporting form for federal institutions, and an updated form for businesses subject to PIPEDA, to make it easier to report breaches.
• Launched the Real Risk of Significant Harm (RROSH) tool, which helps businesses and federal institutions to assess whether a privacy breach creates a RROSH and must be reported to the OPC.
• Improved the efficiency and effectiveness of its activities by taking alternative approaches to full resource-intensive investigations, such as promoting compliance strategically and using different tools that are available to the OPC. This involved including a notable review of LinkedIn’s use of personal data for AI training.
• Closed 89% of PIPEDA (388) complaints and 91% of all complaints under the Privacy Act (1,194) through either early resolution or summary investigations, which are shorter investigations that conclude with a brief report or letter of findings.
• Worked to resolve instances of non-compliance, on a case-by-case basis, by issuing recommendations to federal institutions and private-sector organizations as part of its compliance activities.
• 87% of the OPC’s recommendations were accepted and implemented by organizations found to have contravened federal privacy laws.
• Surveyed Canadians to evaluate their perceptions of how businesses and federal government respect their privacy rights. Results indicated that:
  • Four in ten Canadians (40%) believe that businesses respect their privacy rights, a result that has remained stable since 2022. Meanwhile, six in ten Canadians (62%) believe that the Government of Canada respects their privacy rights, reflecting a four-percentage point increase since 2022.
• Filed an application with the Federal Court to seek an order from the Court to require Aylo, one of the world’s largest operators of pornographic sites, to take steps to bring itself into compliance with Canadian privacy law and give effect to Canadians’ privacy rights.

Result 2: Canadians are empowered to exercise their privacy rights

Results achieved

The OPC contributed to advancing public awareness and understanding of privacy issues and worked to deepen its understanding of youth privacy through research and engagement. As part of these efforts, the OPC:

• Worked to raise public awareness of privacy issues and improve understanding of the rights and responsibilities of individuals and organizations under federal privacy legislation in a timely and accessible manner. To that end, the OPC:
  • Coordinated the 2024 GPEN Sweep which led, among other things, to the publication of tips for individuals on how to identify the most common types of deceptive design patterns – techniques that encourage users to give away personal information online – as well as best practices for businesses to avoid deceptive design patterns.
  • Issued a joint concluding statement on data scraping, with 15 other Data Protection Authorities from around the world – which sets out expectations regarding what organizations should do to ensure that individuals are protected from unlawful data scraping.
  • Developed a new tip sheet with information on how to limit the risk of identity theft. This information was also shared with Canadians across the country through a radio campaign.
  • Promoted educational resources for teachers through email campaigns and exhibits at events attended by educators and librarians to support young people’s privacy education.
  • Reached out to individuals and businesses through its social media channels, publishing content for various awareness campaigns including Privacy Awareness Week, Cybersecurity Awareness Month, Small Business Week, Media Literacy Week, and Data Privacy Week.
• Surveyed Canadians to assess and validate their perceived knowledge of privacy rights. Results indicated that close to half of the Canadians surveyed rated their knowledge of their privacy rights as good (34%) or very good (13%). This result is consistent with past years’ results.
• Obtained feedback from Canadians who read the OPC’s information and find it useful through the OPC’s web survey tool.
  • The OPC’s website is the primary communication channel between the organization and Canadians. Overall, 66% of those who responded using the web-based feedback tool in 2024–25 found the information to be useful. It is important to note that only a minority of web visitors provided feedback. The OPC also conducted a top-task survey on its website to deepen the OPC’s understanding of Canadians’ information needs and improve the web user experience.
• Conducted research to deepen the OPC’s understanding of the privacy issues being experienced by young people, including their understanding of their privacy rights and the security of their personal information. This research will help to inform our guidance and resources for individuals, federal institutions, organizations, and businesses.
  • Research efforts have included focus groups with young people to learn more about their views on their privacy rights and the harms that they face online, and a survey of parents and teachers.
• Signed a joint statement on age assurance issued by the UK Information Commissioner’s Office. The statement sets out principles intended to support age assurance that are accurate and effective, while ensuring user privacy.
• Ran an exploratory consultation on age assurance to enhance the OPC’s understanding of the benefits, concerns, and existing research or writing associated with age assurance and published a summary report. The results of this consultation will inform the preparation of draft guidance on the use and design of age-assurance systems.

Result 3: Parliamentarians, and public and private sector organizations are informed and guided to protect Canadians’ privacy rights

Results achieved

The OPC continued to provide input to Parliament on proposed legislation, participated in studies affecting privacy rights, collaborated with domestic and international regulators, and provided privacy advice to support the compliance efforts of both public and private sector organizations. As part of these efforts, the OPC:

• Advocated for the strengthening of Canada’s privacy laws to effectively recognize, promote, and protect the fundamental right to privacy while enabling responsible innovation and creating conditions for a resilient Canadian economy and a more secure and enriching digital society.
• Provided advice to Parliament on proposed legislation and studies that implicated privacy, including four submissions to Parliament and the government; and eight appearances before House of Commons or Senate committees.
• The OPC continued to monitor bills and studies going through the legislative process for which it had previously provided recommendations. Of its recommendations on bills that completed their parliamentary journey in 2024–25, 89.5% of them were adopted by Parliament.
• Welcomed the unanimous Federal Court of Appeal decision on Facebook, stating that it is an acknowledgement that international data giants must respect Canadian privacy law.
• Promoted better understanding of the rights and obligations under federal privacy legislation, through advice and recommendations to government departments and private-sector organizations. Specifically:
  • Worked closely with federal law enforcement and intelligence communities, consulting and providing advice on initiatives that could impact the privacy of Canadians.
  • Held 18 government advisory events, which were widely attended by representatives from across government both in the ATIP community and program areas. These events reached employees of half of all federal government departments and agencies that are covered under the Privacy Act.
  • Provided advice to businesses to help them ensure that their initiatives and practices for managing personal information comply with PIPEDA by delivering advisory consultations and in‑person and virtual presentations; and held a privacy forum and privacy clinics in various regions of the country in close collaboration with innovation hubs and accelerators.
• Obtained feedback on organizations’ level of satisfaction with OPC guidance through the OPC’s web survey tool. Overall, 78% of the federal and private-sector organizations that responded were satisfied with the usefulness of guidance documents on our website.
• Contributed to advancing cooperation and advocating for greater privacy protection collaboratively with international privacy counterparts, including issuing joint statements with fellow G7 data protection and privacy authorities on fostering trustworthy AI and on AI and children.
• Launched an internal AI strategy to evaluate if and how the OPC might leverage AI to advance its own internal workflows, with the goal of setting an example for how AI can be adopted safely and responsibly.

Key risks

To stay effective amid growing environmental complexity and evolving privacy challenges, the OPC continued to enhance its agility and cost-efficiency through a major organizational transformation – amplifying its impact and driving forward its strategic priorities.

Maintaining employee engagement and well-being in the context of significant internal transformation and mitigating potential negative impacts remained a key priority as the OPC worked to support its staff through a period of significant change. Over the past year, it actively monitored and promoted employee well-being by ensuring staff was not only directly engaged and consulted but also remained well-informed throughout the Office’s reorganization and transformation.

Resources required to achieve results

Table 4: Snapshot of resources required for the Protection of Privacy Rights

Table 4 provides a summary of the planned and actual spending and full-time equivalents required to achieve results.

The Finances section of the Infographic for OPC’s on GC Infobase page and the People section of the Infographic for OPC’s on GC Infobase page provide complete financial and human resources information related to its program inventory.

Related government priorities

This section highlights government priorities that are being addressed through this core responsibility.

United Nations 2030 Agenda for Sustainable Development and the Sustainable Development Goals

More information on the OPC’s contributions to Canada’s Federal Implementation Plan on the 2030 Agenda and the Federal Sustainable Development Strategy can be found in its Departmental Sustainable Development Strategy.

Innovation

The OPC Transformation Plan marks the next step towards strengthening its ability to effectively and efficiently protect and promote the fundamental right to privacy in an increasingly complex and evolving digital world.

The changes will result in greater collaboration and cohesion across the Office and streamline processes, ultimately supporting more integrated, agile and strategic approaches that will maximize the OPC’s impact for Canadians. This will include changes that will allow greater focus on its strategic priorities; respond more rapidly and effectively to emerging issues; evolve its approach to compliance; and bring stronger alignment to its policy and legal work and its enforcement and advisory activities. This has also resulted in a 10% reduction in the number of executive positions at the OPC.

The Transformation Plan reflects significant and thoughtful input that was provided from across the organization during the review, driven by a desire on the part of OPC employees to innovate.

Program inventory

The Protection of Privacy Rights is supported by the following programs:

• Compliance Program
• Promotion Program

Activities related to addressing existing compliance issues fall under the Compliance Program, while activities to bring departments and organizations towards compliance with the law fall under the Promotion Program.

Additional information related to the program inventory for the Protection of Privacy Rights is available on the Results page on GC InfoBase.

Internal services

Description

Internal services refer to the activities and resources that support a department in its work to meet its corporate obligations and deliver its programs. The 10 categories of internal services are:

• Management and Oversight Services
• Communications Services
• Legal Services
• Human Resources Management
• Financial Management
• Information Management
• Information Technology
• Real Property
• Materiel
• Acquisitions

Communications services are an integral part of the OPC’s education and outreach mandate. As such, these services are included in the Promotion Program. Legal services are for its part an integral part of the OPC’s delivery of compliance activities and they are included in the Compliance Program.

Progress on results

This section presents details on how the department performed to achieve results and meet targets for internal services.

In 2024–25, Internal Services led a major reorganization and transformation initiative to enhance organizational impact, streamline activities, and ensure alignment with long-term strategic priorities. With a broad focus on change management and adaptation—including targeted efforts to cultivate a healthy, resilient workforce—Internal Services responded effectively to the evolving needs of the OPC, delivering timely and efficient support across the organization.

To enable effective program delivery, Internal Services undertook the following key initiatives:

• developed and launched the Integrated Human Resources Plan (IHRP) 2025–30 unifying Human Resources, Employment Equity, Diversity and Inclusion, and Official Languages priorities into a single, cohesive framework. This plan is designed to help bridge the gap between current and future workforce needs, and ensure sound people management across the organization.
• strengthened the hybrid work model to ensure staff had access to modern tools that facilitated maximum flexibility and productivity in both remote and office environments.
• reviewed the training, learning, and development program to ensure alignment with the organization’s mandate and objectives.
• conducted a review of the Internal Control over Financial Reporting framework.

Resources required to achieve results

Table 5: Resources required to achieve results for internal services this year

Table 5 provides a summary of the planned and actual spending and full-time equivalents (FTEs) required to achieve results.

The Finances section of the Infographic for OPC on GC Infobase and the People section of the Infographic for OPC on GC Infobase provide complete financial and human resources information related to its program inventory.

Contracts awarded to Indigenous businesses

Government of Canada departments are required to award at least 5% of the total value of contracts to Indigenous businesses every year.

Office of the Privacy Commissioner of Canada results for 2024–25

Table 6: Total value of contracts awarded to Indigenous businesses

As shown in Table 6, OPC awarded 10.7 % of the total value of all contracts to Indigenous businesses for the fiscal year. In its 2025–26 Departmental Plan, the OPC estimated that it would award 10% of the total value of its contracts to Indigenous businesses by the end of 2024–25. The OPC met its target as a significant part of our procurement was done through PSPC procurement tools that include Indigenous businesses, and we consistently invited them to participate in the processes.

Spending and human resources

Spending

This section presents an overview of the department’s actual and planned expenditures from 2022–23 to 2027–28.

Refocusing Government Spending

While not officially part of this spending reduction exercise, to respect the spirit of this exercise, the OPC undertook the following measures in 2024–25.

The OPC launched a strategic review. Through research, consultation, and reflection, the Office worked to broaden its impact and sharpen its strategic priorities, focusing on maximizing the impact of the OPC, addressing the privacy implications of technology such as artificial intelligence (AI), and championing children’s privacy. This process set in motion a significant reorganization and transformation within the organization to maximize efficiencies and synergies across the Office and continue to direct resources to priority areas where it can achieve the greatest outcomes for Canadians.

Budgetary performance summary

Table 7: Actual three-year spending on core responsibilities and internal services (dollars)

Table 7 shows the money that OPC spent in each of the past three years on its core responsibilities and on internal services.

Analysis of the past three years of spending

The variance between the 2024–25 Main Estimates and the 2024–25 total authorities available for use is due to the following:

• funding received for the operating budget carry forward from 2023–24 to 2024–25;
• compensation adjustments to fund salary increases to meet obligations under new collective agreements;
• the temporary funding received as part of Budget 2023 to reduce the backlog of privacy complaints and effectively address privacy breaches across public and private organizations; and
• the temporary funding received as part of Budget 2023 for preparation activities required to implement the Consumer Privacy Protection Act proposed as part of Bill C-27.

The increase in expenses is mainly attributed to additional spending on staffing resulting from new hires, as well as salary increases, and retroactive payments made following the ratification of collective agreements over the past years.

The Finances section of the Infographic for OPC on GC Infobase offers more financial information from previous years.

Table 8: Planned three-year spending on core responsibilities and internal services (dollars)

Table 8 shows OPC’s planned spending for each of the next three years on its core responsibilities and on internal services.

Analysis of the next three years of spending

Budgetary spending for the 2025–26 fiscal year corresponds to the OPC’s planned spending. It includes:

• funding received for the collective agreements;
• the temporary funding received to reduce the backlog of privacy complaints and effectively address privacy breaches across public and private organizations; and
• the temporary funding received as part of Budget 2023, namely the funding for preparation activities required to implement the Consumer Privacy Protection Act proposed as part of Bill C‑27.

The reduction in planned spending for the 2026–27 fiscal year and beyond is the result of the end of the above-mentioned temporary funding.

The Finances section of the Infographic for OPC on GC Infobase offers more detailed financial information related to future years.

Funding

This section provides an overview of the department’s voted and statutory funding for its core responsibilities and for internal services. Consult the Government of Canada budgets and expenditures for further information on funding authorities.

Graph 1: Approved funding (statutory and voted) over a six-year period

Graph 1 summarizes the department’s approved voted and statutory funding from 2022–23 to 2027–28.

Analysis of statutory and voted funding over a six-year period

The above graph illustrates the OPC’s spending trend over a six-year period from 2022–23 to 2027–28. Fiscal years 2022–23 to 2024–25 reflect the organization’s actual expenditures as reported in the Public Accounts. Fiscal years 2025–26 to 2027–28 represent planned spending.

The increased actual spending in 2024–25 and planned spending in 2025–26 is mainly attributable to salary increases, and to retroactive payments made following the ratification of collective agreements over the past years. It is also attributable to the temporary funding received in Budget 2023, namely the funding for activities required to prepare for the implementation of the Consumer Privacy Protection Act that was proposed as part of Bill C-27, and the funding received to reduce the backlog of privacy complaints and address privacy breaches. The OPC anticipates a decrease in its planned spending in 2026–27. When this temporary funding comes to an end, the OPC’s planned spending will level off at $32.4 million.

Consult the Public Accounts of Canada for further information on the OPC’s departmental voted and statutory expenditures.

Financial statement highlights

The OPC’s Financial Statements (Audited) for the Year Ended March 31, 2025, are available online.

Table 9: Condensed Statement of Operations (audited) for the year ended March 31, 2025 (dollars)

Table 9 summarizes the expenses and revenues for 2024–25 which net to the cost of operations before government funding and transfers.

Analysis of expenses and revenues for 2024–25

The difference between the 2024–25 actual results and the 2024–25 planned results is mainly attributable to salary increases, and to retroactive payments made following the ratification of collective agreements over the past years. It is also attributable to the temporary funding received in Budget 2023, namely the funding for activities required to prepare for the implementation of the Consumer Privacy Protection Act that was proposed as part of Bill C-27, and the funding received to reduce the backlog of privacy complaints and address privacy breaches. The 2024–25 planned results information is provided in the OPC’s Future-Oriented Statement of Operations and Notes 2024–25.

Table 10: Condensed Statement of Operations (audited) for 2023–24 and 2024–25 (dollars)

Table 10 summarizes actual expenses and revenues and shows the net cost of operations before government funding and transfers.

Analysis of differences in expenses and revenues between 2023–24 and 2024–25

In 2024–25, actual spending increased from 2023–24. The increase can be attributed to an increase in personnel expenditures due to the temporary funding received in Budget 2023, namely the funding for activities required to prepare for the implementation of the Consumer Privacy Protection Act that was proposed as part of Bill C-27, and the funding received to reduce the backlog of privacy complaints and address privacy breaches. It is also attributable to increases in salary ranges and to retroactive payments made following the ratification of collective agreements over the past years.

Table 11: Condensed Statement of Financial Position (audited) as of March 31, 2025 (dollars)

Table 11 provides a brief snapshot of the amounts the department owes or must spend (liabilities) and its available resources (assets), which helps to indicate its ability to carry out programs and services.

Analysis of department’s liabilities and assets since last fiscal year

The net financial position decreased $0.7 million compared to 2023–24 due to decreases in net liabilities, net financial assets and non-financial assets. The difference in net financial assets and non-financial assets is largely due to a decrease in payables at year end, prepaid expenses and less acquisitions of tangible capital assets.

Human resources

This section presents an overview of the department’s actual and planned human resources from 2022–23 to 2027–28.

Table 12: Actual human resources for core responsibilities and internal services

Table 12 shows a summary in full-time equivalents of human resources for OPC’s core responsibilities and for its internal services for the previous three fiscal years.

Analysis of human resources for the last three years

The increase in 2024–25 actual FTEs is due to the temporary funding received as part of Budget 2023 to reduce the backlog of privacy complaints and to address privacy breaches as well as the temporary funding received as part of Budget 2023 for preparation activities required to implement the Consumer Privacy Protection Act proposed as part of Bill C‑27.

Table 13: Human resources planning summary for core responsibilities and internal services

Table 13 shows the planned full-time equivalents for each of OPC’s core responsibilities and for its internal services for the next three years. Human resources for the current fiscal year are forecast based on year to date.

Analysis of human resources for the next three years

The increase in 2025–26 planned FTEs is due to the temporary funding received as part of Budget 2023, namely the funding for preparation activities required to implement the Consumer Privacy Protection Act that was proposed as part of Bill C-27, and the funding received to reduce the backlog of privacy complaints and to address privacy breaches. The planned FTEs for 2026–27 and 2027–28 remain stable at 207 FTEs. The OPC will continue to achieve results by allocating its human resources to best support its priorities and programs.

Supplementary information tables

The following supplementary information tables are available on the OPC’s website:

• Details on transfer payment programs
• Gender‑based Analysis Plus

Federal tax expenditures

The tax system can be used to achieve public policy objectives through the application of special measures such as low tax rates, exemptions, deductions, deferrals and credits. The Department of Finance Canada publishes cost estimates and projections for these measures each year in the Report on Federal Tax Expenditures. This report also provides detailed background information on tax expenditures, including descriptions, objectives, historical information and references to related federal spending programs as well as evaluations and GBA Plus of tax expenditures.

Corporate information