Key Organizational Initiatives

Hybrid Office

Leads:
1. Deputy Commissioner, Corporate Management Sector
2. Director, Finance and Administration

Background

• The OPC has remained operational throughout the COVID-19 pandemic while respecting public health guidelines. Teleworking remains an effective solution, and employees continue to provide a high level of service.
• Over the last two years, employees have been informed and consulted in preparation for the OPC’s transition to a hybrid model.
• The OPC is transitioning to a hybrid model and recently launched the Collaborative Workplace Initiative.

Current status

• In office presence is currently at less than 5%. A gradual return to the office is anticipated over the coming months, depending on public health guidelines.
• A working group has been meeting frequently to advance the transition to a hybrid model and the initiative for a hybrid workplace.
• The transition to an unassigned environment has begun, and collaborative space is being added. This initiative will continue over the course of the 2022-2023 fiscal year.
• The hybrid model vision was shared with employees in December 2021. A communication plan was developed, and employees are receiving regular updates.
• The initiative has a limited budget, and only part of the plan will be able to be completed during the 2022-2023 fiscal year.

Next steps

• The Commissioner will receive updates from the Chief Financial Officer on the status of the project, plans and associated decisions.

---

Cloud Migration

Lead Directorate: Information Management & Information Technology Directorate

Background

• The OPC is currently in the design phase (Phase 1) of the implementation of the Microsoft 365 suite of cloud applications. These applications include Outlook, OneDrive, SharePoint and Teams, which use Azure cloud data centres located in Canada. Microsoft 365 cloud services are used to gather, store, share and distribute information in a cloud environment.
• Implementing cloud services will modernize the technology currently used by the OPC and will improve OPC operations by adding new features to the OPC’s current product portfolio. This implementation will foster efficient and effective data management to support OPC programs and service delivery. It is also consistent with the Government of Canada’s strategy, directives and guidance on cloud adoption.

Current status

• Commissioner Therrien authorized operation at the Protected B level in February 2022.
• The strategy and migration plan are in development.

Strategic considerations

• There is a memorandum of understanding with the European Data Protection Supervisor (EDPS) for the sharing of issues surrounding the use of the Microsoft 365 cloud platform.

Next steps

• Migrate electronic documents from Officium to SharePoint Online and investigation cases from MS Dynamics 365 to PowerApps.

Further reading

• Presentation to the Executive Management Board Plus of April 27, 2022.

---

Security Infrastructure Upgrade

Lead Directorates:
1. Privacy Act Compliance Directorate
2. Compliance, Intake and Resolution Directorate
3. Finance and Administration Directorate
4. Information Management & Information Technology Directorate

Background

• The OPC’s current physical and electronic security infrastructure does not permit its employees to:
  • Retain, discuss work on, or draft content that is of a Top Secret classification or above;
  • Effectively send or receive information classified above a Protected B designation with institutions responding to an investigation, or other key investigative stakeholders, such as the National Security and Intelligence Review Agency (NSIRA); or
  • Conduct verbal or transport written communication outside the OPC’s physical offices for information above Protected B, other than paper copies transported in an appropriate container.
• This is significantly impeding the OPC’s ability to effectively carry out its Privacy Act compliance mandate in the National Security field. It also impacts the Government Advisory Directorate’s ability to offer its services to institutions in the National Security field, where it has noted increased demand in the last two years.
• In an ever-increasing digital environment, respondent institutions and key partners such as NSIRA must find increasingly burdensome ways of working around the OPC’s limited security infrastructure. [Redacted]
• The quality of the OPC’s work in the National Security field is also significantly affected as employees must rely on memory and cannot easily engage in discussions or fact cross-checking.
• [Redacted]

Current status

• Steps are under way to seek the approvals necessary to gain access to CTSN and to commence a needs assessment and feasibility work study.

Strategic considerations

• A key challenge to implementing an effective solution in a timely way is funding, as the full costs would likely exceed what could be reasonably absorbed within the OPC’s budget without unduly impacting other activities. The recently released Government of Canada budget included some funding for security activities, which may present an opportunity to seek funding. Cost reduction options (such as shared or borrowed infrastructure elsewhere) are an alternative but will nonetheless impose a start-up and ongoing cost on the OPC and may include additional timeline risks due to other stakeholder priorities and needs.

Next steps

• Several teams within the OPC are working to develop a strategy, including funding vehicle options, for implementation of a short-term and medium-term solution.

---

Compliance Sector Classification Review

Lead Sector: Compliance Sector

Background

• There are several current regulatory demands in the privacy field, including increasing complexity in balancing economic interests and privacy rights in novel data-driven business models leveraging emerging technologies, impacting the skills needed within the Compliance Sector.
• Compliance is also increasingly relying on the use of formal powers in evidence gathering, including conducting site visits, compelling testimony under oath, and issuing production orders. This trend will only accelerate under law reform.
• The global data protection regulatory community, as well as Commissioner Therrien, has recognized the need for multi-disciplinary enforcement teams equipped to lead increasingly complex investigations in the ever-evolving digital economy.
• PIPEDA, which falls under the federal government’s Trade and Commerce powers, expressly requires the balancing of businesses needs and privacy rights with a view to fostering a stronger digital economy. Further, the Privacy Act Compliance Directorate is increasingly investigating matters involving public-private partnerships.
• Compliance investigators are currently classified within the Program Administration (PM) classification, ranging from PM-04 to PM-06, consistent with employees who provide delivery of government services and with investigators examining more administrative matters such as official languages or access to information. The work carried out by the OPC’s investigators is more akin to that of investigators at the Competition Bureau and Canadian Radio-television and Telecommunications Commission, who have embraced the materially higher CO classification.
• Compliance has successfully, though temporarily, recruited investigators from fields including commerce, law and technology. The results have been validating and highly impactful, but the OPC has been unable to retain these investigators under the current salary structure.

Current status

• The Compliance Sector is working with the OPC’s Human Resources Directorate (HR) for re-classification of some or all investigation positions from PM to Commerce (CO), Computer Systems (CS) and/or Economic and Social Science Services (EC).
• The purposes of the re-classification are to maintain leadership position and remain competitive across regulatory counterparts, and to attract and retain employees with appropriate skills and experience capable of leading complex investigations.

Strategic considerations

• In absence of re-classification, there is a risk that the OPC will not be able to recruit and retain employees with the necessary competencies to effectively investigate and resolve the increasingly complex investigations described above.

Next steps

• HR has hired a consultant to conduct a review and update of all investigations job descriptions, as well as, potentially, a job validation review (formerly known as a “desk audit”).
• A job evaluation committee will then proceed with a classification evaluation with respect to those revised descriptions.

---

Business Intelligence

Business Intelligence Officers:

• Anne Maloney (Corporate Management Sector)
• Mely Jean Claude (Compliance Sector)
• Daphné Rodgers (Policy and Promotion Sector)

Lead Sectors: All

Purpose

• With the rapidly evolving privacy landscape, as well as the OPC’s expanding mandate, the Business Intelligence positions were created to build a Business Intelligence function. The objective for the Business Intelligence function is to support and facilitate decision-making based on operational intelligence in a strategic and proactive manner.

Background

• In 2019, the Business Intelligence Officer positions were created using a decentralized model, with one individual serving as Business Intelligence Officer and Strategic Advisor per sector. While working in close collaboration with one another, each Business Intelligence Officer reports directly to their respective Deputy Commissioner.
• The OPC is in the process of building a Business Intelligence capability to better leverage the use of its data to support evidence-based decision-making, to facilitate the sharing of strategic information to Executive Management and to identify privacy risks to Canadians.
• With a view of increasing the maturity level and laying the foundation for the Business Intelligence function across the OPC, the Business Intelligence Officers have led and completed various initiatives including internal consultations across the office to identify the business needs and benchmarking consultations with foreign counterparts and government of Canada agencies/organizations.

Next steps

• The Business Intelligence Officers will continue to collaborate with IM/IT and subject matter experts to develop the structural/procedural foundation and optimize the Business Intelligence function. This includes improving the processes and methods of accessing, collecting, storing, sharing and analyzing data.

Further reading

• OPC Intranet, Shifting for results: Update on business intelligence