Vision, mission, raison d’être and operating context – 2024-25 Departmental Results Report

Vision, mission, raison d’être

As an agent of Parliament, the Privacy Commissioner of Canada reports directly to the House of Commons and the Senate. The mandate of the Office of the Privacy Commissioner of Canada (OPC) is to oversee compliance with both the Privacy Act, which covers the personal information-handling practices of federal government institutions, and the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s federal private sector privacy law, along with some aspects of Canada’s anti-spam legislation (CASL). The OPC’s mission is to protect and promote the privacy rights of individuals.^{Footnote 1}

The Privacy Commissioner’s powers to further the privacy rights of Canadians include:

• investigating complaints, conducting audits and pursuing court action under the authority of the Privacy Act and PIPEDA;
• publicly reporting on the personal information-handling practices of public and private sector organizations;
• supporting, undertaking and publishing research into privacy issues; and
• promoting public awareness and understanding of privacy issues, including appearing before Parliament on proposed legislation and studies on issues affecting the privacy rights of Canadians.

The Commissioner works independently of government to investigate federal public sector-related complaints from individuals under the Privacy Act, and complaints related to the private sector under PIPEDA. He also has some designated responsibilities to ensure compliance with CASL.

The Commissioner may address complaints through mediation and conciliation; he also has the power to summon witnesses, administer oaths, and compel the production of evidence. In cases where the investigation does not result in a voluntary agreement/resolution and remains unresolved, the Commissioner may seek an order from the Federal Court to address the situation under certain circumstances.

Operating context

The Office of the Privacy Commissioner of Canada (OPC) operates in a constantly evolving environment, with technological advancements transforming our world. New technologies are being fueled by an unprecedented and massive collection of data, including Canadians’ personal information.

In this shifting landscape, data breaches continue to be a significant issue of concern. It is essential that both public institutions and private organizations prioritize information security, as there can be serious consequences for individuals whose personal information is impacted by a privacy breach.

In addition to data breaches, over the past fiscal year, key issues such as generative AI and children’s privacy have defined both domestic and international privacy conversations and have been central to the OPC’s work.

When Parliament was prorogued in January 2025, all bills under consideration, including those for which the Privacy Commissioner had appeared before Parliamentary committees, died on the order paper. This included Bill C-27, which would have modernized Canada’s federal private-sector privacy law by enacting the Consumer Privacy Protection Act and the Artificial Intelligence and Data Act.

Progress on efforts to modernize Canada’s privacy laws remains essential. To that end, the OPC continues to advocate for modernized laws that recognize privacy as a fundamental right, while advancing the public interest and a strong Canadian economy. In the interim, Canada’s existing privacy laws continue to apply, including for new technologies such as generative AI, and the Office remains committed to their application.

The volume and complexity of complaints and breaches reported to the OPC continued to grow in the last year. The Office leveraged the temporary funding received as part of Budget 2023 for 2024–25 to adequately respond to privacy breaches reported by public and private sector organizations, and to investigate privacy complaints from the public in a timely manner. While these temporary funds were helpful, fulfilling the OPC’s existing mandate—and meeting any new legislative requirements—will require additional permanent funding.

Against this backdrop, the Office seized the opportunity to strengthen its adaptability in response to the growing complex environment and enhance its service delivery to Canadians. Among ongoing efforts to advance legislative reform and secure additional resources, the OPC launched a strategic review last fall. Through research, consultation, and reflection, the Office worked to broaden its impact and sharpen its strategic priorities, focusing on maximizing the impact of the OPC, addressing the privacy implications of technology such as artificial intelligence (AI), and championing children’s privacy. This process set in motion a significant reorganization and transformation within the organization to maximize efficiencies and synergies across the Office and to direct resources to priority areas where it can achieve the greatest outcomes for Canadians.

Finally, in March 2025, the OPC acquired responsibility for a new oversight function as a result of changes to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations (PCMLTFR). The Office is responsible for reviewing and approving codes of practice developed by reporting entities under the PCMLTFA that relate to the sharing of personal information among reporting entities without an individual’s consent, under section 11.01 of the PCMLTFA.