2021-22 Departmental Results Report (DRR)

Operating context

A number of factors affected the operating context of the Office of the Privacy Commissioner of Canada (OPC) in 2021-22:

The OPC’s strategic and operating environments are constantly evolving given the exponential speed of technological change, the array of new business models and different means of collecting and manipulating data, which have long overtaken privacy protections. The COVID-19 pandemic helped to accelerate an already fast-moving digital revolution, as technologies were developed to help ensure that we can continue performing essential and regular activities remotely and safely. Privacy risks related to those advances are multiplying in number and complexity and are heightened by the fact that our laws are out of date.

It has been clear for many years that Canada’s two federal privacy laws are not suited to the task of protecting privacy rights in a digital world. We need to better protect Canadians at a time when their confidence in the digital economy is needed to fuel a post-pandemic economic recovery.

Unfortunately, while there have been recent efforts to modernize our federal privacy laws, these did not come to fruition in the last year. In November 2020, the federal government introduced Bill C-11, which sought to overhaul the federal private sector law. The Department of Justice also held comprehensive public consultations which resulted in a document laying out a plan for modernizing Canada’s nearly 40-year-old public sector law. By March 2022, the proposed reforms had not resulted in reformed privacy laws, with C-11 having died on the order paper when an election was called in August 2021 and a bill to reform the Privacy Act having yet to be introduced. Our office therefore had to contend with outdated privacy laws. Our office nevertheless initiated transition planning to prepare the OPC for an expanded mandate post-privacy law reform, both functionally and structurally.

The OPC received funding as part of Budget 2019 to enhance its ability to deliver on its mandated obligations within the current legislative framework in the face of the exponential growth of the digital economy. This included temporary funding to clear the growing backlog of complaints older than 12 months. We have made great strides in reducing the overall backlog, and in fact had reduced it by 90% as of April 1, 2021, with only 15% of cases being in backlog status by March 31, 2022. This temporary funding increased our short-term capacity to deal with complaints; but unfortunately, it was not a permanent solution to help us deal appropriately with the full volume and complexity of compliance issues emerging on a daily basis and ended in March 2022.

Additionally in 2021-22, the government announced the coming into force of the Privacy Act Extension Order No. 3^{Footnote 1} in July 2022^{Footnote 2}, empowering foreign nationals abroad with the same right as Canadians and individuals present in Canada to request access to personal information about themselves that is under the control of federal government institutions. This order is expected to place considerable strain on the office’s resources responsible for compliance functions. The OPC explored mechanisms to enhance its capacity to respond to the anticipated impact on complaints volume, including supplementary funding vehicles and engaging with similarly affected departments on mitigation strategies. At the time of drafting this report, work was still ongoing on that front.

Internally, our office was able to meet the challenge brought by the second year of the COVID-19 pandemic upheavals and remained fully functional and operational. While the majority of our employees continued to work remotely, employees continued to access the office to complete key activities that required presence in the workplace.