Raison d’être and operating context - 2024-25 Departmental Plan

Raison d’être, mandate and role: who we are and what we do

Raison d’être

As an agent of Parliament, the Privacy Commissioner of Canada reports directly to the House of Commons and the Senate. The mandate of the Office of the Privacy Commissioner of Canada (OPC) is to oversee compliance with both the Privacy Act, which covers the personal information-handling practices of federal government institutions, and the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s federal private sector privacy law, along with some aspects of Canada’s anti-spam legislation (CASL). The OPC’s mission is to protect and promote the privacy rights of individuals.^{Footnote 1}

Mandate and role

The Privacy Commissioner’s powers to further the privacy rights of Canadians include:

• investigating complaints, conducting audits and pursuing court action under the authority of the Privacy Act and PIPEDA;
• publicly reporting on the personal information-handling practices of public and private sector organizations;
• supporting, undertaking and publishing research into privacy issues; and
• promoting public awareness and understanding of privacy issues, including appearing before Parliament on proposed legislation and studies on issues affecting the privacy rights of Canadians.

The Commissioner works independently of government to investigate federal public sector-related complaints from individuals under the Privacy Act, and complaints related to the private sector under PIPEDA. He also has some designated responsibilities to ensure compliance with CASL.

The Commissioner may address complaints through mediation and conciliation; he also has the power to summon witnesses, administer oaths, and compel the production of evidence. In cases where the investigation does not result in a voluntary agreement/resolution and remains unresolved, the Commissioner may seek an order from the Federal Court to address the situation under certain circumstances.

Operating context

The OPC’s strategic and operating context is constantly evolving, given that emerging technologies and novel uses of personal data are developing at an increasingly rapid pace. The swift evolution of technology—big data, the Internet of Things, biometrics, and artificial intelligence, among other innovations—is continuing to have a tremendous impact on privacy. New technologies offer encouraging and exciting possibilities for meeting many of the collective challenges that we face in improving the lives, safety, and security of Canadians. At the same time, they raise potential risks with respect to privacy, human rights, transparency, and accountability. Addressing the privacy impacts of rapidly advancing technology is a key focus area for the OPC. Helping Canadians to benefit from these new technological opportunities while finding the right ways to protect and promote our fundamental right to privacy will be a key challenge for Canada’s institutions in the coming years.

An important step toward meeting this challenge was taken with the introduction of Bill C‑27, the Digital Charter Implementation Act, in June 2022, which is now being studied by the House of Commons Standing Committee on Industry and Technology. We welcomed the opportunity in Fall 2023 to assist the Committee with its study and provided our advice and key recommendations to help ensure that this legislation will protect and promote Canadians’ fundamental right to privacy, including in the context of artificial intelligence. We are encouraged by the introduction of this bill and look forward to seeing it progress through the legislative process.

Meanwhile, we continue looking ahead in preparation for legislative reform, should Parliament adopt Bill C‑27. The OPC has been conducting benchmarking exercises against other privacy regulators and costing exercises to ensure that we will be ready to take on the new responsibilities laid out in the bill and to provide support to Canadians and businesses as they navigate the new legislative framework.

Operationally, the complexity of our work continues to grow. The OPC must develop and maintain a high level of privacy expertise and become increasingly knowledgeable regarding an ever-expanding range of issues, technologies, and practices.

To remain effective within the rapidly evolving and complex privacy landscape, the OPC has developed a three year strategic plan that serves as a tool to inform its choices and direct its efforts toward areas where there is the greatest risks and potential impact.

Temporary funding received in Budget 2023 to undertake more in-depth reviews and investigations of privacy breaches and improve response times for privacy complaints will provide much-needed relief to address operational pressures in our Compliance Program. Similarly, once accessed the temporary funding set aside as part of Budget 2023 to help us prepare for the implementation of new mandate obligations stemming from C-27 will allow the OPC to more effectively navigate this important transition period. We welcome these funds, and we will put them to good use to better serve Canadians. However, they are not a permanent solution. To appropriately deal with the full volume and complexity of privacy issues, it is essential that the OPC be adequately resourced on an ongoing basis. We will continue to present fiscally responsible funding requests.

---