Draft Policy on PIPEDA Guidance Consultations

Introduction

Stakeholder consultations are an important part of how the OPC develops guidance for businesses.

By consulting on our guidance, OPC is better positioned to develop guidance that is timely, effective, responsive to stakeholder needs, and targeted towards key issues. Consulting helps us to develop clear and practical advice for compliance with privacy obligations and improving privacy protection.

The Policy on PIPEDA Guidance Consultation applies to comprehensive guidance documents developed by the OPC on privacy requirements under the Personal Information Protection and Electronic Documents Act (PIPEDA). The policy sets out the OPC’s approach to the consultation process on PIPEDA guidance and is intended to set clear and consistent expectations around our consultation procedures.

Businesses and other organizations can also request a consultation with OPC for advice about their specific practices and activities. These one-on-one engagements are conducted through the OPC’s Promotion and Engagement Directorate and are not subject to the OPC Guidance Consultation Policy^{Footnote 1}.

What is guidance?

OPC issues guidance to assist organizations in understanding and complying with their privacy obligations under PIPEDA. Our guidance is meant to clarify how and when privacy laws apply, identify best practices for privacy protection, highlight key privacy risks, and clarify regulatory expectations.

OPC generally issues guidance in three areas:

• Guidance on how privacy law applies to the use of a technology – such as the use of facial recognition or other biometric technologies;
• Guidance on how privacy law applies in certain situations or circumstances, or to a set of activities – such as privacy in the workplace; and
• Guidance on the interpretation of certain elements of the law – such as guidance on consent provisions under PIPEDA.

Regardless of the topic at hand, OPC guidance is meant to provide clear advice about what organizations must and should do to comply with the law.

Who do we consult with?

The privacy issues addressed in our guidance can have significant impacts on a wide range of individuals, groups, and organizations. We are therefore interested in gathering a diverse range of perspectives during our guidance consultations.

This includes input from:

• Businesses, industry representatives, and trade associations
• Civil society and not-for-profit organizations
• Representatives of Indigenous communities
• Legal and academic professionals
• Individual members of the public
• Other groups, associations, professionals or organizations who wish to participate

What guidance do we consult on?

In general, OPC conducts consultations on guidance pieces that aim to provide comprehensive and in-depth explanation, interpretation and advice. OPC does not generally conduct consultations on shorter or more targeted guidance materials, such as interpretation bulletins, tip sheets, and other tools and resources.

What guidance is not

The OPC’s role is to oversee compliance with federal privacy statutes and to promote the protection of privacy rights. The OPC is not able to change privacy requirements under the law or create new binding rules for organizations. OPC guidance is limited to providing interpretations of existing law.

Consultation process

By consulting with stakeholders about guidance, OPC can gain insight into the challenges organizations face when complying with privacy obligations, and the questions organizations have about how privacy law applies to their activities. Consultations also help us to better understand the privacy risks involved, and the impacts of practices and technologies on individuals and groups.

To ensure guidance consultations are effective and consistent with the OPC Code of Conduct, the OPC is committed to implementing consultations that are:

• Open to input from a wide range of stakeholders
• Efficient in the use of time and resources
• Meaningful, by ensuring stakeholder input has an impact
• Fair to all stakeholders who wish to participate, and
• Transparent in the procedures we use

With these considerations in mind, OPC has developed a consultation policy that involves input at different stages of the guidance development process, uses consistent procedures, and is accessible to diverse stakeholder groups.

Call for comments and written feedback

Early in the process of drafting guidance, OPC issues an open call for comments on the topic. The call sets out the general parameters of the guidance and may indicate preliminary positions, recommendations, considerations, and/or areas of focus. This provides an opportunity for stakeholder views to be considered when making early decisions about the structure and content of guidance documents, including which areas to focus on.

Stakeholders are invited to provide feedback on these preliminary aspects of the guidance, and to comment on any additional considerations that may be helpful. For example, stakeholders might point to best practices they are familiar with, use cases that are relevant and could be considered when drafting the guidance, key compliance challenges they are facing, or parts of the law where further clarity would be helpful.

The call for comments is posted publicly to the OPC website and is open to all organizations and individuals for comment. Submissions can be made by email in Word, PDF, or text format, and are accepted for 60 days after the opening of the consultation.

Alternative formats for accepting feedback can be made on a case-by-case basis for organizations and individuals who request an accommodation. Accommodation requests, and questions regarding consultation procedures, can be made by contacting the OPC, either by email (using the email address provided in the Call for Comments), by phone, or by mail.

Stakeholder meetings

OPC may decide to organize meetings with stakeholder group representatives and Indigenous communities in addition to the public call for comments. Stakeholder meetings can provide important context for feedback received during the call for comments and provide an opportunity to explore stakeholder perspectives in greater detail.

These meetings generally take the form of roundtable meetings, during which representatives of stakeholder groups are asked to share their perspectives on issues relating to the guidance and the call for comments. Meetings are hosted and moderated by the OPC. The OPC may also organize one-on-one meetings with specific stakeholders in certain circumstances, for example, where a stakeholder has unique and highly relevant expertise. Given limited OPC resources, one-on-one meetings are held infrequently.

The organization and hosting of stakeholder meetings is determined based on the nature and scope of the guidance, OPC resources, and the availability of external representatives.

Timelines for consulting

Consultations can have a significant impact on the timeline for publishing guidance. To help ensure that guidance is made available to businesses and organizations when it is needed most, the OPC limits the duration of consultations on guidance pieces under development. This allows us to issue guidance that remains timely and relevant. For the same reason, multiple public consultation periods are not opened for the same guidance piece while it is under development.

Consultations on new PIPEDA guidance documents are open for a period of 60 days after the Call for Comments is posted to the OPC website. Roundtable meetings, when held, are scheduled within the 60-day consultation period.

Feedback analysis and guidance drafting

After the call for comments has closed, and following any stakeholder meetings, OPC analyzes the feedback received and incorporates suggestions and recommendations into the development of a guidance document.

OPC commits to giving fair, impartial, and reasonable consideration to all feedback received during consultation. This means feedback is weighed in light of the perspectives of other stakeholders, the scope, objectives, and audience for the guidance, and operational considerations relating to drafting and publication. Feedback that violates the OPC Comment Policy is not considered within the scope of guidance consultations.

When the guidance document is complete, it is published on the OPC website.

Open engagement

The OPC regularly reviews all guidance documents published on the OPC website. This means that each guidance piece is periodically assessed for relevance, completeness, and potential improvements. Guidance may also be reviewed in response to new information or circumstances, including changes in the regulatory or technological environment, or compelling stakeholder input.

Following the publication of guidance on the OPC website, the OPC continues to accept feedback from stakeholders. This feedback is reviewed on an ongoing basis and is taken into consideration when guidance documents are assessed for potential improvements. Feedback can be submitted to OPC on any guidance piece by sending comments to cpvp-opcconsultation1@priv.gc.ca. Feedback can be submitted as text or in Word or PDF formats.

Removing or archiving guidance

Guidance that is outdated or no longer relevant (for example, because of a change in the law or technological developments) may be permanently removed from the OPC website or archived. When guidance is archived, the guidance document may remain available on the OPC website for reference, research or recordkeeping purposes, but will no longer be considered active guidance. Guidance is removed from the website when it becomes redundant or outdated.

Guidance documents that have been archived are clearly marked as such on the OPC website and are no longer open for stakeholder input.

How can I participate in an OPC guidance consultation?

Anyone can participate in an OPC guidance consultation by making a submission to a call for comments or by submitting feedback through the open engagement process. Consultation input is reviewed and analyzed systematically, and contributes to the development, assessment, and revision of OPC guidance documents.

Calls for comment are posted regularly on the OPC website. We also announce new calls for comment on our social media channels.

Submissions that violate Canadian law or violate our Comment Policy will not be considered within scope of our guidance consultations.

Does OPC post submissions on its website?

Submissions are not posted on the OPC website, but we may post summaries of feedback that we receive, and we may share summaries of feedback with external organizations. The summaries will not attribute views or feedback we received to any specific individual or organization.

The OPC is subject to the Access to Information Act and the Privacy Act. The Access to Information Act provides a public right of access to government records. The Privacy Act provides individuals with a right of access to their own personal information and protects that information from unauthorized disclosure.

Feedback provided to us in guidance consultation processes may be accessible to third parties outside of the OPC under the Access to Information Act. However, this does not apply to any personal information (as defined in the Privacy Act) that may be associated with your submission.

How does the OPC handle personal information collected during consultations?

Please see the OPC’s Privacy Policy, Terms and Conditions, and Comment Policy for how we handle your information. The personal information you provide will be used and may be disclosed for the purpose for which the information was obtained or compiled by the OPC, or for a use consistent with that purpose.

If you have a question unrelated to this call for comments, please use our Online information request form or contact our Information Centre. Feedback will not be treated as a privacy complaint under the Privacy Act or PIPEDA. For further information on filing complaints under either Act, please see File a formal privacy complaint.