Office of the Privacy Commissioner of Canada’s 2023–24 Departmental results report

Description

Ensure the protection of privacy rights of Canadians; enforce privacy obligations by federal government institutions and private-sector organizations; provide advice to Parliament on potential privacy implications of proposed legislation and government programs; promote awareness and understanding of rights and obligations under federal privacy legislation.

Progress on results

This section presents details on how the department performed to achieve results and meet targets for the Protection of Privacy Rights. Details are presented by departmental result.

Table 1: Targets and results for the Protection of Privacy Rights

Table 1 provides a summary of the target and actual results for each indicator associated with the results under the Protection of Privacy Rights.

Additional information on the detailed results and performance information for the OPC’s program inventory is available on GC InfoBase.

Details on results

The following section describes the results for the Protection of Privacy Rights in 2023–24 compared with the planned results set out in the OPC’s departmental plan for the year.

Privacy rights are respected and obligations are met.

Results achieved

• Focused on providing Canadians with a strong, fair, accessible and timely compliance process, and took actions that improved the protection of Canadians’ personal information and delivered results that make a real difference in their lives.
  • Completed 28% more Privacy Act investigations (1,278) compared to the previous year (999), with 87% (1,107) of complaints closed through either early resolution or summary investigation.
  • Closed 90% of PIPEDA complaints (363) using early resolution.
  • Worked to provide timely responses to Canadians’ complaints. Although the OPC did not meet its 75% target, it reduced the ongoing overall investigative backlog by 4%, which comprises investigations under the Privacy Act and PIPEDA.
• Worked to resolve instances of non-compliance after the fact, on a case-by case basis, by issuing recommendations to federal institutions and private-sector organizations as part of its compliance activities. In 2023-24, 82% of the OPC’s recommendations were accepted and implemented by organizations found to have contravened federal privacy laws, which is slightly below the target of 85%.
• Concluded high-impact investigations into a number of matters, including Aylo (formerly MindGeek), the operator behind Pornhub and other popular pornographic sites; the Royal Canadian Mounted Police’s (RCMP) Project Wide Awake initiative; and the federal government’s privacy practices in relation to measures adopted during the COVID-19 pandemic.
• Launched high profile investigations into Open AI, the company behind ChatGPT; TikTok; and the development of the ArriveCAN app.
• Continued to review breach reports on the basis of a real risk of significant harm and ensured that adequate actions were taken by breached organizations, and, to the extent that our limited resources permitted, conducted formal investigations into a number of major breach incidents, including:
  • Launching investigations into a data breach at Global Affairs Canada and a data breach involving personal information that was held by BGRS and its affiliated company (Sirva), which are contracted by the Government of Canada to provide relocation services for employees.
  • Releasing a special report to Parliament on a major privacy breach at the Canada Revenue Agency and Employment and Social Development Canada involving vast amounts of sensitive personal information.
• Sought clarification from the Federal Court of Appeal on whether Facebook had contravened PIPEDA by failing to obtain meaningful consent from users for the disclosure of their personal information and by not safeguarding that information.
• Obtained clarification from the Federal Court of Appeal that Google’s search engine is subject to federal privacy law when it indexes web pages and presents results in response to searches of a person’s name.
• Leveraged and made effective use of the OPC’s modernized technology laboratory to maintain, acquire and implement a sufficient repository of knowledge of new developments in technology and to provide better support for investigative activities and research development.

Canadians are empowered to exercise their privacy rights.

Results achieved

• Provided advice and information to Canadians in a timely and accessible manner through the development and delivery of communications announcements, media relations, social media, the OPC website, educational materials, outreach activities, and responses to public inquiries.
• Reached tens of thousands of Canadians through campaigns during Privacy Awareness Week, Cybersecurity Month, Small Business Week, Media Literacy Week, Data Privacy Week and Fraud Prevention Month.
• Exhibited at events, engaging with youth, parents, educators, librarians, newcomers and seniors at in-person events across the country.
• Promoted educational resources for teachers through email campaigns and provided information to Canadians through a radio campaign on the importance of creating strong and unique passwords.
• Updated online guidance for individuals and published blogs to support knowledge of key technological issues and trends such as homomorphic encryption and algorithmic fairness.
• The OPC’s website is the primary communication channel between the organization and Canadians. Overall, 63% to 65% of those who responded using the web-based feedback tool in 2023-24 found the information to be useful, which is below the target of 70%. It is important to note that only a minority of web visitors provided feedback. Work is underway to better understand Canadians’ information needs and improve the web user experience, including through top tasks analysis and web usability best practices. This work will support the OPC in making data-driven improvements to enhance the effectiveness of its online resources and the overall user satisfaction.

Parliamentarians, and public and private sector organizations are informed and guided to protect Canadians’ privacy rights.

Results achieved

• Promoted better understanding of the rights and obligations under federal privacy legislation, through advice and recommendations to government departments and private-sector organizations. Specifically:
  • Reviewed 123 privacy impact assessments (PIAs), held 89 advisory consultations and issued 137 letters of recommendation and advice to government institutions following PIA review or consultation.
  • Launched the new online submission form to make it easier for federal institutions to submit PIAs.
  • Conducted 79 outreach and stakeholder relations activities, hosted 4 privacy clinics for small- and medium-sized enterprises and carried out 16 consultations and proactive engagements.
• Surveyed Canadian businesses on privacy-related issues. To ensure that Canadians’ privacy rights are protected, it is necessary that businesses understand their obligations under federal privacy laws. Results indicate that 88% of private sector organizations surveyed rate themselves as moderately or highly aware of their responsibilities under Canada’s privacy laws. This result exceeds the target of 85% and has been relatively consistent since 2018.
• Advocated for the strengthening of Canada’s privacy laws and provided advice to Parliament to ensure that laws adopted effectively recognize, promote and protect the fundamental right to privacy while enabling responsible innovation.
  • The Commissioner presented his submission on Bill C-27, a bill to modernize federal private-sector privacy law, and made 15 key recommendations to Parliament to strengthen the bill.
  • In total, the OPC made six submissions to Parliament and the government and appeared before the House of Commons and Senate committees 10 times in 2023–24.
  • Of the OPC’s recommendations on bills and studies that completed their parliamentary journey in 2023–24, 50% of them were adopted by Parliament. For example, two privacy-related amendments were made to the Online Streaming Act (C-11) that aligned with the recommendations put forward by the OPC.
  • Continued to plan and prepare for the implementation of Bill C-27.

Key risks

To remain effective in these increasingly uncertain and fiscally challenging times, the OPC continued to maximize its agility and cost-effectiveness through continuous assessment and by streamlining program and service delivery. To guide and focus the OPC’s efforts on areas of greatest risk and potential impact, the Commissioner launched a three-year Strategic Plan, and continued to engage with government officials to raise awareness of its funding needs.

Employee engagement and well-being remained top priorities for the OPC, as it sought to effectively support employees during a period of change, the uncertainties brought about by legislative reform, and the adaptation to a new hybrid work environment. Over the past year, the OPC monitored and supported the well-being of its employees by, among other things, investing in change-management capabilities, responding concretely to the results of the 2022 Public Service Employee Survey and consulting employees in a meaningful way on the issues that affect them most.

Resources required to achieve results

Table 2: Snapshot of resources required for the Protection of Privacy Rights

Table 2 provides a summary of the planned and actual spending and full-time equivalents (FTEs) required to achieve results.

Complete financial and human resources information for the OPC’s program inventory is available on GC InfoBase.

Related government-wide priorities

United Nations 2030 Agenda for Sustainable Development and the Sustainable Development Goals

In 2023–24, the OPC developed its sustainable development strategy and sought to implement the contributions for which it is responsible, taking into account its mandate and size.

More information on OPC’s contributions to Canada’s Federal Implementation Plan on the 2030 Agenda and the Federal Sustainable Development Strategy can be found in its 2023–27 Departmental Sustainable Development Strategy.

Innovation

The OPC continued to foster a culture that embraces experimentation and innovation and assessed whether tools, techniques and practices remained relevant to its new challenges. The OPC continued its migration to the cloud to make communication and collaboration more efficient and to offer access to innovative tools. It also continued to champion Beyond 2020 initiatives to innovate wherever possible and explore solutions to enhance its capacity within its limited resources.

Program inventory

The Protection of Privacy Rights is supported by the following programs:

• Compliance Program
• Promotion Program

Activities related to addressing existing compliance issues fall under the compliance program, while activities to bring departments and organizations towards compliance with the law fall under the promotion program.

Additional information related to the program inventory for the Protection of Privacy Rights is available on the Results page on GC InfoBase.

Description

Internal services are the services that are provided within a department so that it can meet its corporate obligations and deliver its programs. There are 10 categories of internal services:

• management and oversight services
• communications services
• legal services
• human resources management services
• financial management services
• information management services
• information technology services
• real property management services
• materiel management services
• acquisition management services.

Communications services are an integral part of the OPC’s education and outreach mandate. As such, these services are included in the Promotion Program. Similarly, as legal services are an integral part of the OPC’s delivery of compliance activities, they are included in the Compliance Program.

Progress on results

This section presents details on how the department performed to achieve results and meet targets for internal services.

Internal services continued to evolve with and adapt to the changing needs and context of the OPC. They continued to focus broadly on organizational change and adaptation, including to support a healthy and resilient workforce. Furthermore, they seized opportunities in new modes of working to provide a high level of service in terms of addressing privacy matters of greatest risk to Canadians.

During 2023–24, internal services continued to strengthen the culture of respect, inclusion and accessibility to leverage the full potential of employees and produce better results for Canadians. They supported, engaged and enabled employees during a time of transformation as the OPC fully transitioned to a hybrid model. They also continued their efforts to optimize the employee experience to attract, retain and develop talent, by investing in employee well-being, talent management, engagement initiatives and flexible work arrangements.

The following actions highlight this year’s accomplishments in internal services:

• Led the development of the OPC’s three-year Strategic Plan, which serves as a tool to inform the OPC’s choices and direct its efforts toward areas where there is the greatest risks and potential impact.
• Implemented the OPC’s hybrid work model, designed with a view to promote greater collaboration and provide employees with the necessary support and the equipment they need to optimize services to Canadians.
• Provided support to the organization as required, to allow the OPC to effectively advance its priorities and to prepare to carry out new expanded mandate obligations. This included reviewing recruitment and attraction strategies, job descriptions, contracting plans and reviewing our internal processes.
• Fostered employee engagement through targeted conversations and events on the strategic direction of the organization, on values and ethics and on the Public Service Employee Survey results.
• Implemented more accessible services for both employees and Canadians by integrating key actions from the Accessibility Plan into the operational plans.
• Continued carrying out the OPC’s digital transformation by upgrading processes, infrastructure and tools to optimize service delivery and accessibility, and promoting employee mobility, especially by continuing to migrate OPC’s information technology systems to the cloud.
• Continued to implement the priorities and activities of the OPC’s Security Plan to comply with the requirements of the Policy on Government Security and achieve the security objectives set out in the plan.
• Continued to maintain collaboration and business partnerships with other small- and medium-sized organizations and agents of Parliament, in order to gain effectiveness, share tools and resources and implement best practices in areas such as information technology, administrative services, finance, internal audit, people management and human resources programs.

Resources required to achieve results

Table 3: Resources required to achieve results for internal services this year

Table 3 provides a summary of the planned and actual spending and full-time equivalents (FTEs) required to achieve results.

The complete financial and human resources information for the OPC’s program inventory is available on GC InfoBase.

Contracts awarded to Indigenous businesses

Government of Canada departments are to meet a target of awarding at least 5% of the total value of contracts to Indigenous businesses each year. This commitment is to be fully implemented by the end of 2024–25.

The OPC is a Phase 3 department and is aiming to continue to achieve the minimum 5% target by the end of 2024–25 by:

• Transitioning business processes to incorporate Indigenous procurement methods in the planning stages;
• Continuing to award contracts to Indigenous businesses mainly through prequalified vendors when using various standing offers and other government procurement tools; and
• Increasing voluntary set-asides when Indigenous capacity exists and operational requirements, best value, prudence, probity and sound contracting management can be assured.