Evaluation of work under the Strategic Privacy Priorities

Management Response and Action Plan

Evaluation Recommendations

(Text taken integrally from Final Report)

---

1) The OPC should revisit its process and approach for consultations.

This would be undertaken with a view to:

• Ensuring the process is structured, specific, and clearly defined for all who are involved;
• Engaging stakeholders early, allowing for adequate time to provide input;
• Giving stakeholders the opportunity to react to draft guidance;
• Consulting with youth specifically as appropriate;
• Building in consent to be contacted for feedback into consultation processes; and,
• Developing a list of stakeholders that can be approached directly on future work as it unfolds.

Management Response

The OPC agrees with this recommendation. We are currently examining our consultation process as we prepare for a transition due to legislative reform. Provisions under both bill C-11 and the proposal outlined in the Department of Justice’s discussion paper on Privacy Act modernization would make consultation on guidance by the OPC mandatory.

As part of our work in preparation for reformed federal privacy laws, we are planning for how mandatory stakeholder consultations will be carried out in a way that considers the views of stakeholder, maintains our office’s independence and ensures that the protection of privacy remains at the forefront of our work.

We agree that hearing from varied and diverse stakeholders is fundamental to the work we do and will continue to advance our ability to consult a representative sample of Canadians including voices that are historically under represented and systemically oppressed. The OPC intends to consult a wide array of communities including but not limited to civil society as we strive to consider those impacted by corporate practices while maintaining awareness of important industry needs.

Action Plan

Action Items

We are in the midst of developing processes for guidance development more globally, which will include designing and running guidance consultations with stakeholders. More specifically the OPC is developing a structured consultation process to ensure guidance development is informed by stakeholder views so that the resulting guidance is practical, effective and addresses current privacy challenges.

Elements are already being used as the Office runs its stakeholder consultation for draft facial recognition guidance, which is scheduled to conclude in mid-October.

Approx. due date: Month/Year

Subject to influence from the current law reform transition work, we tentatively anticipate a due date of Dec 31 2021.

Responsibility

Policy, Research and Parliamentary Affaires (PRPA)

---

2) The OPC should identify ways to integrate industry expertise.

Options for this might include an external business advisory committee, re-visit lessons learned from historical previous committees that were in place, and take the best practices available from those experiences. Targeted recruitment of staff from the private sector might also help, as would clarifying and enhancing the role and visibility of business advisory directorate.

Management Response

The OPC agrees with this recommendation and always strives to incorporate industry knowledge into our work; however, it is important to recognize that industry needs are not always in harmony with our organizational mandate, which can be mistakenly perceived as a lack of integration on our part.

The OPC must engage with several stakeholders, not only industry groups, and independently come up with guidance and positions that both recognize business interests and protect privacy rights. We will strive to improve our engagement strategies and practices, in a balanced way. This would likely include the creation of one or more advisory groups.

Action Plan

Action Items

As we continue to expand, we will seek to hire individuals from a diverse array of backgrounds and experience, including private sector, academia, civil society, lawyers, economists, technologists, etc.

We will continue to engage with businesses through initiatives such as our privacy clinics, and focus those efforts on increasing our visibility and ensuring that industry have a clear understanding of the services available to them through our business advisory (BA) function.

Our Office will consider establishing an external advisory committee comprised of diverse and representative stakeholders, including business representatives, which would provide us with valuable insight. As our Office continues to grow and prepares for transition as new legislation progresses, we anticipate obtaining clarity on where relations with this body might fit into the organizational structure of our Office, as well as affiliated resourcing requirements.

Approx. due date: Month/Year

Ongoing

Responsibility

BA / PRPA / Compliance

Under our current organizational structure, it is unclear who would be best suited to lead this work. We anticipate our transition work in response to legal reform will make this clear.

---

3) The OPC should establish specific mechanisms to hear from youth.

This might include options such as establishing a youth advisory council, and/or presence within major youth privacy fora. Such undertakings would be meant to promote OPC’s visibility within this space, and also to hear first-hand the concerns of youth and their proposed solutions. Duplicating efforts of funded organizations to educate youth on privacy issues should be avoided.

Management Response

The OPC agrees with this recommendation. We are cognizant that children use a wide array of services in which privacy plays a meaningful role, some of which are not marketed towards them. We agree that children’s voices on these matters need to be sought out and heard.

Given that the OPC is a small organization and direct collaboration with youth can be a resource-intensive process, our approach has been to avoid duplication of efforts through consulting organizations that collaborate directly with youth.

To have an expanded youth engagement program would require more funding. At this time, we are limited by our current budget and available resources.

That being said, we will explore options for more direct engagement with youth that do not require significant funding. We will undertake this work as part of a broader update to our education and outreach efforts aimed at vulnerable populations, which could include, for example, youth, seniors, Indigenous people and newer Canadians.

In keeping with our response to the second recommendation, we believe that a diverse and representative advisory committee including youth representation would benefit our Office and provide meaningful insight.

Action Plan

Action Items

As pandemic restrictions ease, we will look for youth engagement opportunities to attend within the 2021-22 fiscal year in order to engage directly with youth more informally.

We will consult other federal organizations to determine how they interact directly with youth and other vulnerable populations. We will also build a repertoire of events that will include youth engagement opportunities and expand to vulnerable groups.

We will incorporate the new tactics and events identified through the above exercise (as resources permit) into our public education and outreach strategy beginning in 2022-23.

Approx. due date: Month/Year

March 31, 2022

March 31, 2022

April 1, 2022 onwards

Responsibility

Director, Strategic Communications

Consultation on new communications products may be required with PRPA, Compliance and Legal.