Proactive Activities

Lead Sector: Policy and Promotion Sector

Background

• In 2018, the OPC adopted a new structure to support Commissioner Therrien’s vision to be more proactive, and to focus efforts where there can be an impact for the greatest number of Canadians.
• In changing its approach as a regulator, the OPC’s preferred focus has been on informing Canadians of their rights and how to exercise them and engaging with organizations on how to comply with their privacy obligations.
• The OPC’s goal has been to address privacy issues upfront and to resolve matters cooperatively, outside of formal enforcement, avoiding time-consuming and costly investigations and helping to mitigate against future privacy risks.
• The OPC’s proactive activities offer organizations a measure of consistency and predictability in their dealings with the OPC and allows everyone to benefit from innovation.
• Key aspects of the OPC’s proactive approach by program area include:
  1. Policy and Promotion Sector: Activities aimed at bringing departments and organizations towards compliance with the law, such as:
     • Publishing guidance and information for businesses and individuals;
     • Working with industry proactively and collaboratively in an advisory capacity, to better understand the privacy impacts of new technologies and provide practical advice on how to use them in a privacy compliant way; and
     • Engaging with government stakeholders early in the development of programs and activities through advisory consultations and the review of Privacy Impact Assessments.
  2. Compliance Sector: Addressing existing compliance issues through proactive enforcement efforts such as:
     • Targeting systemic, chronic or sector-specific privacy issues that are not being addressed through the complaint system and that we believe may inflict significant damage to the privacy rights of Canadians through Commissioner-initiated investigations; and
     • Conducting audits in certain cases to review issues that pose a high risk to individuals’ privacy rights but that are not being addressed through the complaint system.

Current status

• The results of the OPC’s proactive approach are measured through the Office’s Departmental Results Framework, which includes a set of performance indicators and targets. The OPC reports publicly against these targets on an annual basis in our Departmental Results Report.
• The OPC sets ambitious objectives, given the interests at stake for Canadians. While progress has been made, despite best efforts and the infusion of resources, the OPC has been unable to meet all of its targets.

Strategic considerations

• The OPC continues to seek stronger enforcement powers through law reform. Even if successful, it will be necessary to maintain a strong proactive role to ensure effective protection of privacy rights.
• Bill C-11 would have introduced some measures that expanded the OPC’s promotional program activities, consistent with our proactive strategy. However, the Bill’s non-discretionary approach to these responsibilities meant the OPC’s limited capacity would likely have been fully occupied by mandatory activities. In response, the OPC recommended that the proposed Consumer Privacy Protection Act provide the OPC discretion to allocate resources applying a risk-based approach.
• Similarly, the OPC’s response to the Department of Justice’s consultation on Modernizing the Privacy Act identifies many areas under both the current and proposed regime where enhancements could be made that would provide the OPC with more discretion to manage its limited resources to the overall end of being a responsive and effective regulator.

Next steps

• Sectoral operational plans have been developed in support of proactive objectives, taking into consideration the OPC’s current operating context and the uncertainty brought about by law reform.

Further reading

• 2017-18 Annual Report to Parliament, A proactive vision for privacy protection