Appearance before the Standing Committee on Access to Information, Privacy and Ethics on Main Estimates 2013-14: Vote 45 under JUSTICE

April 22, 2013
Ottawa, Ontario

Opening Statement by Jennifer Stoddart
Privacy Commissioner of Canada

(Check against delivery)

---

Introduction

Good afternoon, Mister Chair and members of the Committee. It’s a pleasure to be here today to discuss our Office’s Main Estimates for this fiscal year. Joining me today are Assistant Commissioner, Chantal Bernier, along with our Chief Financial Officer and Director-General of Corporate Services, Daniel Nadeau.

During my time today, I look forward to outlining and discussing some of our major priorities for the year ahead.

For our Office, this is a year marked by both continuity and transition. On one hand, our main program activities remain the same.  On the other, we will see change in the form of moving to a new headquarters and to a change in leadership.

I’ll start by talking about what remains the same.

Planned spending by program area

Overall, we have a planned operating budget of 29.1 million dollars spread among four key program activities. First, we have the program activity of compliance, which includes the investigation of privacy related complaints as well as reviewing privacy impact assessments and undertaking audits of organizations.  And in the coming year, this area will account for just over 11.1 million dollars of our budget.

Next, we plan to devote some 4.6 million dollars to the area of research and policy development, under which we examine emerging privacy issues as well as provide advice to Parliament on the privacy aspects of proposed legislation.   

In order to continue informing individuals of their privacy rights and organizations of their obligations under the law, we intend to invest just over 3.1 million dollars to the public education and outreach program activity.

And finally, we intend to direct just more than 10.1 million dollars to the area of Internal Services which includes functions such as human resources, administration and asset management.  This both represents an increase from the last fiscal year and accounts for an overall increase in our budget. I want to take a moment to explain why.  

In short, the increase you see is caused by a one-year injection to cover our costs brought on by the move of our headquarters; one made necessary by a long-term retrofit to our current space. 

Orderly transition

While we are a relatively small organization, relocation comes with expense, and our costs are being covered by a 4.1 million dollar interest free loan; one which we will repay Treasury Board Secretariat over the next 15 years.

Our move will put us in the same building as some fellow Agents of Parliament and we have planned several cost efficiencies through common and shared services and are exploring even more.  Already we have made arrangements to share a common reception desk, a library, a server room and mail processing room.   

This action contributes to our wider commitment to continuously improving our business processes to make the most of our existing resources.  This is an important priority for our organization given the current economic environment.  As I noted in last year’s remarks, while not mandated to make reductions under the Deficit Reduction Action Plan, our Office answered the call to adhere to its spirit and intent. As a result, we will have implemented savings of 5% or $1.1M per year within our total budget by fiscal year 2014-15.

In sum, while our figures show an increase because of the cost of our move, the resources we have available to meet the privacy needs of Canadians largely remain at the levels set for the last fiscal year. We made the decision to implement savings while committing to maintain the best possible level of service for Canadians. That commitment remains solidly intact for this year and underlines the need to make the most efficient use as possible of our existing resources.

Adapting for the privacy landscape of today and tomorrow

As we look at the present and the future, we can all rest assured that the ever-quickening pace of technological change and its relationship with privacy will remain a constant. This is why we have created a Technology Analysis Branch to support investigations and audits.

Over the years, as Canadians’ interest and awareness of privacy issues has increased, complaints have risen.  Years ago the rise in complaints prompted a need for further funding to deal with a backlog.  Today, I’m happy to say that we have made efforts to maximize existing resources to continue getting the results that Canadians expect and deserve. 

Last year, we engaged in a project to simplify investigation procedures under the Privacy Act and reduce the time required to investigate complaints.  This year, we plan to implement the improvements that this project identified in order to continue providing Canadians with results at a lower administrative burden.

Going further, we plan to broaden this project to complaints under PIPEDA.

Helping privacy laws and OPC priorities keep pace with change

In short, from both a technological and a privacy perspective, to say that the world has changed immensely in 10 years would be an understatement – and the law needs to catch up with the times.  As a result, we strongly suggest that action to bring needed change takes place as soon as possible.

With only a few months remaining in my final term, it appears more and more doubtful that a second review of PIPEDA – one that is overdue – will occur before I am replaced.  Nonetheless, in the coming year, our Office will work to set out a roadmap to address current and future privacy challenges more effectively; one that will examine how organizations can be given greater incentive to invest in privacy and information security.

In the absence of such incentives, it’s up to our investigation process to bring about needed improvements – and while some companies are very cooperative, the process is generally long, drawn-out and resource-intensive. While I certainly can’t speak for the Committee, I think most can agree that it shouldn’t be Canadian taxpayers footing an unnecessarily large bill to fund the privacy improvements of businesses. 

In addition, I want to remind everyone here about the work we undertook in the past calling for reform of the Privacy Act.  This Act was written during a time when information was stored in fixed filing rooms, rather than on USB sticks and portable hard drives. 

Serving individuals, enabling organizations

Staying with the Privacy Act for now, I would be remiss if I didn’t take a moment to note the concerns Canadians have registered in the form of complaints stemming from some large scale federal data breaches over the past few months. 

This is a concern our Office shares with federal departments, with Parliament along with Canadians. And in the coming months, we hope to provide information to Parliament from our investigations into the loss at HRSDC of a hard drive and USB key containing the personal information of more than 500,000 Canadians.

In addition, to explore systemic challenges relating to the use of portable electronic storage devices by federal organizations, we plan to begin an audit in this regard.  And further, we will be releasing reports on audits of both FINTRAC and the Canada Revenue Agency.

Audit findings provide recommendations for subject organizations to follow. They can serve as guidance for other departments to improve practices. Our Office also seeks to provide guidance to the private sector, and especially smaller businesses.

In the year ahead, our Office will continue our proactive approach toward identifying and exploring emerging privacy challenges. We have our eyes on several issues, including:

• mobile payments;
• facial recognition software;
• intergovernmental information sharing; and
• how consent for collecting personal information online is obtained.

Conclusion

In closing now, let me underscore that my management team is wholly committed to ensuring this year of transition - both to our new location and to new leadership - comes with no effect on service to Canadians.

In the last year of my mandate, I plan to do everything I can to ensure an orderly and positive transition to new leadership upon my retirement in December.

Mister Chair, I think all around the table can agree on the fact that privacy issues are challenging and increasingly closer to home for more and more Canadians.  In order for this Office to continue functioning as efficiently as possible throughout the course of the year, we are working with officials from the Privy Council Office to begin the competitive process to find a new Commissioner in the near future. 

As you all know, Parliament has a key role to play in the process of approving a new Privacy Commissioner, so I wish you well in your future deliberations on this matter.  And with that now, I look forward to your questions.