News release

OPC’s annual report highlights efforts to protect privacy in a data-driven world

Gatineau, QC, September 19, 2023 – The Privacy Commissioner of Canada’s annual report tabled today in Parliament highlights his Office’s efforts over the past year to protect and promote the fundamental privacy rights of Canadians in this digital era.

At a time where both public and private sector organizations are increasingly seeking creative ways to leverage personal data, the impact of emerging technologies on personal privacy has been a priority for Commissioner Philippe Dufresne during the first year of his mandate.

The Office of the Privacy Commissioner of Canada’s (OPC) investigations in the past year have highlighted the wide range of privacy issues that Canadians face, and the impact of data-driven technologies on privacy.

The OPC launched investigations into TikTok as well as ChatGPT’s parent company, OpenAI, with provincial counterparts. The OPC also issued findings and recommendations following an investigation into Home Depot, where the personal information of customers who opted for an electronic receipt at checkout instead of a printed one was shared with a social media company without their express consent. In addition, the OPC followed up on recommendations arising from last year’s investigation into the Tim Hortons mobile app, which collected vast amounts of sensitive location data from users. Both Home Depot and Tim Hortons implemented the OPC’s recommendations, resulting in improved privacy protection for millions of Canadians.

In another investigation this year, the OPC examined a Canada Post program that involves building marketing lists from various sources, including the shopping habits of millions of people gleaned from envelopes and packages that it delivers to homes across Canada, and making these lists available to advertisers for a fee. The OPC recommended that Canada Post proactively reach out to Canadians to explain the program and how individuals can opt out. While the organization has taken steps to increase transparency by updating information about the program online and adding brochures at retail outlets, it did not agree to a proactive mail-out to obtain the authorization of Canadians – a solution proposed by the OPC to satisfy its recommendation.

Also of note this year was a Special Report to Parliament presenting the results of several investigations and advisory initiatives that examined the federal government’s privacy practices in relation to measures adopted during the COVID-19 pandemic.

“Privacy touches every aspect of our lives. Our work over the last year highlights how many of our daily activities – such as socializing online, using mobile apps, getting packages delivered, or going to the check-out counter – can raise privacy issues,” says Privacy Commissioner of Canada Philippe Dufresne.

“Canadians should not have to choose between participating fully in society and protecting their fundamental privacy rights,” says Commissioner Dufresne.

In his annual report message, Commissioner Dufresne sets out three strategic priorities for the work of his Office: staying ahead of the fast-moving pace of technological advancement, especially in the world of artificial intelligence (AI) and generative AI; protecting children’s privacy; and preparing for potential law reform should Bill C-27, the Digital Charter Implementation Act, be adopted by Parliament.

Building privacy protections into new technologies from the start is key to creating public trust in the digital tools that aim to improve and simplify our everyday lives. This is especially true in the quickly evolving field of AI and generative AI. Protecting privacy in the face of rapidly evolving technology has been a key focus of the OPC’s work with other data protection authorities.

The joint investigations into the company that owns ChatGPT, as well as into TikTok, one of the most popular sites for children and minors, will determine whether they are complying with their obligations under the Personal information Protection and Electronic Documents Act (PIPEDA), which governs the private sector.

The OPC has advocated for a new private-sector privacy law and has provided advice and recommendations to Parliament on law reform and privacy matters of public interest and importance. The Commissioner’s submission on Bill C-27 contains 15 key recommendations to improve the Bill, including that it recognize privacy as a fundamental right and that it better protect children’s privacy and the best interests of the child.

The OPC accepted 1,241 complaints under the Privacy Act in 2022-23, and 454 under PIPEDA.

The OPC continues to be concerned about possible under-reporting of breach incidents in the public sector. The number of reported breaches fell by 36 % to 298 last year, and only one of those reports involved a cyber-attack, compared to the private sector where 681 breaches were reported, of which 278 were cyber related.