Appearance before the Standing Committee on Access to Information, Privacy and Ethics (ETHI) on the on the 2019-20 Main Estimates

May 7, 2019
Ottawa, Ontario

Opening statement by Daniel Therrien
Privacy Commissioner of Canada

(Check against delivery)

---

Introduction

Good morning Mr. Chair and members of the committee.

Thank you for the opportunity to appear before you to discuss the 2019-20 Main Estimates. With me today are Deputy Commissioner, Compliance, Brent Homan; Deputy Commissioner, Policy and Promotion, Gregory Smolynec; and Deputy Commissioner, Corporate Management, Daniel Nadeau.

In the time allocated, I will discuss some of our plans for the coming year and how we expect to make use of the new funding announced in the recent federal budget, which comes in recognition of growing demands on my office.

Our annual resources have been approximately $24 million in recent years. We hope to have your support in maintaining that funding.

We plan to use the additional resources to enhance our ability to deliver on our mandated obligations in the face of the exponential growth and complexity of the digital economy. Privacy issues are multiplying rapidly and often adversely affect Canadians’ privacy. It has been an ongoing challenge to keep pace with those advancements and to protect Canadians in the way they deserve.

We require program integrity funding to enhance our capacity to protect the privacy rights of individuals and achieve meaningful results for Canadians.

We welcome the recent federal budget announcement of additional resources for my office as a positive step. It would allow us to take concrete steps towards implementing our proactive vision for privacy protection.

Investigative backlog

Part of the funding included in the federal budget is temporary, to help us deal with a backlog of complaints.

While we have undertaken initiatives such as the increased use of early resolution and the revamping of our investigative processes, we have nevertheless struggled to respond to complaints in a timely manner.

We currently have a backlog of more than 300 complaints older than a year. The new funds would allow us to reduce the backlog to approximately 10 percent of its size by 2021. We would also be in a much better position to achieve our goal of meeting service standard targets in 75 percent of cases.

Ultimately, however, we think the best solution in the enforcement area is to modernize legislation, in part to give the OPC greater authority to manage its caseload according to risk. We need the discretion to focus our efforts on those cases with the greatest impact on Canadians.

Breach reporting

Our Compliance Program has also been facing significant pressures brought about by new legislative and policy requirements related to breaches. 

Since mandatory breach reporting requirements came into effect under PIPEDA in November 2018, our office has seen the volume of reports increase to more than five times what it was when reporting was voluntary. At present, we can only superficially respond to the vast majority of private sector breach reports to our office.

New resources would enable the OPC to more thoroughly review 40 percent of private sector breach reports to our office and 15 percent of public sector breach reports.

Informing Canadians and guiding organizations

The  number of privacy issues for which Parliamentarians, businesses and individuals require our advice and guidance is multiplying at a rapid pace. The challenge for the OPC is to keep pace with the speed of technological advancements, when it is in a continual dynamic state of evolution.

In the past five years, requests for advice to Parliament have risen considerably, and this trend is expected to continue. Calls from various Parliamentary Committees are up 41 percent from five years ago and in 2017-18 alone, we made 34 Parliamentary appearances and submissions.

In the coming year, we will remain responsive to Parliamentarians’ request for advice on the privacy implications of bills and studies, and we will seek to contribute to the adoption of laws that improve privacy protection.

New resources would also help increase our capacity to inform Canadians of privacy issues relevant to new technologies, their rights and how to exercise them. As well, we would be better positioned to guide organizations on how to meet their privacy obligations.

With current capacity, we can produce a maximum of three new pieces of guidance a year. We have developed an ambitious plan for much-needed guidance related to a wide range of important issues. Guidance to be developed over the next few years includes important issues such as biometrics, the internet of things, social media, and de-identification, among others. 

As well, existing advice and guidance needs to be updated to ensure that OPC’s web site continues to be a trusted and comprehensive source for both organizations and individuals. There are over 150 guidance pieces on the OPC’s website, approximately 40 percent of which are five years old or more.

Another important area for our office in providing guidance involves our advisory services to both industry and government. The new funding would help support our work with industry proactively in an advisory capacity, to better understand, advise and help mitigate any privacy impacts at the design stage of their services.

Finally, I would add that guidance needs to be complemented by sustained and effective communications and outreach to have a meaningful or significant impact on awareness and understanding of rights and obligations.

We would like to increase our capacity to conduct more public education and outreach activities to have a greater impact on awareness and understanding of privacy rights and obligations.

Legislative reform

Of course, as you have heard me say before, our federal privacy laws require a number of very urgent reforms. As our recent Facebook investigation so starkly illustrated, we have reached a critical tipping point upon which privacy rights and democratic values are at stake.

I look forward to discussing those issues with you in detail a little later.

Conclusion

Keeping pace with the rapid changes in technology is going to be an ongoing challenge for our Office.

We will continue to make optimal use of resources given to us to carry out our mandate — to have a greater impact on the privacy rights of Canadians. The recently announced new funding is an important interim measure and positive step towards achieving our targets as we await much-needed legislative modernization.

Thank you Mr. Chair and members of the Committee. I look forward to your questions.