Treasury Board of Canada Secretariat
www.tbs-sct.gc.ca
Common menu bar links
Breadcrumb Trail
ARCHIVED - Office of the Privacy Commissioner of Canada
This page has been archived.
Archived Content
Information identified as archived on the Web is for reference, research or recordkeeping purposes. It has not been altered or updated after the date of archiving. Web pages that are archived on the Web are not subject to the Government of Canada Web Standards. As per the Communications Policy of the Government of Canada, you can request alternate formats on the "Contact Us" page.
Section II: Analysis of Program Activities
2.1 Strategic Outcome
All of the OPC efforts and activities are directed towards the achievement of its single Strategic Outcome to protect the privacy rights of individuals. That said, the OPC is one of several advocates and catalysts that contribute to this goal, with the Office specifically having a lead role. This is to clarify its specific contribution as having a lead role to influence those that handle Canadians' personal information, so that they respect the privacy rights of individuals and protect their personal information. Other advocates and catalysts include: provincial and territorial privacy commissioners, international data protection authorities, privacy advocacy groups, chief privacy officers, professional associations, consumer representatives, academics and international organizations as well as Parliamentary Committees and government departments and agencies.
Strategic Outcome
The privacy rights of individuals are protected.
| Expected Result | Performance Indicator | Target |
|---|---|---|
| Ultimate Outcome for Canadians | ||
| The OPC plays a lead role in influencing federal government institutions and private sector organizations to respect the privacy rights of individuals and protect their personal information. | Extent and direction of change in the privacy practices of federal government institutions and private sector organizations. | Target to be established once a baseline is set in 2009-2010 (Note: baseline to be updated approximately every five years; reporting on this indicator and target to start in 2010-2011). |
| Performance Measurement Strategy |
|---|
This "umbrella" indicator" will result in a narrative based on performance information generated from several indicators under the OPC Program Activities (PA) as well as other sources of information, including (but not limited to):
|
The activities carried out to support all OPC Program Activities will contribute to the Strategic Outcome. In 2009-2010, we will continue to focus our investigative, audit, research, outreach and other activities and be guided by four priority privacy issues as per our second corporate priority: "Provide leadership to advance issues relating to: information technology, national security, identity integrity and protection, and genetic information."
The following sections describe the OPC's program activities and identify for each one: the expected results, performance indicators, targets and performance measurement strategy, financial and human resources, planning highlights for the planning period and benefits to Canadians. Note that some performance indicators published in last year's Report on Plans and Priorities have been revised to provide a more accurate or reliable performance information for decision-making and reporting.
2.2 Program Activity 1: Compliance Activities
Activity Description
The OPC is responsible for investigating complaints and responding to inquiries received from individuals and organizations that contact the OPC for advice and assistance on a wide range of privacy-related issues. The OPC also assesses, through audits and reviews, how well organizations are complying with requirements set out in the two federal laws and provides recommendations on privacy impact assessments (PIAs) pursuant to the Treasury Board Secretariat policy. This activity is supported by a legal team that provides specialized legal advice and litigation support, and a research team with senior technical and risk assessment support.
| Expected Results | Performance Indicators | Targets |
|---|---|---|
| Intermediate Outcomes | ||
| Individuals receive effective responses to their inquiries and complaints. | Timeliness of OPC responses to inquiries and complaints. (Analysis of Office statistics on turnaround time and backlog status) | Note: the OPC is undergoing a major review of its inquiry and complaint investigation processes, based upon which service standards will be revised and serve as targets. |
| Federal government institutions and private sector organizations meet their obligations under federal privacy legislation and implement modern practices of personal information protection. | Extent to which investigation and audit recommendations are accepted and implemented over time. (Tracking and analysis of responses to investigation and audit reports) | 90% of investigation recommendations are accepted and implemented. 90% of audit recommendations are accepted fully by entities. Upon re-audit, two years after the initial report, action to implement has begun on 90% of recommendations |
| OPC recommendations that are not resolved through the investigation process are advanced before the Courts, where possible. (Review and analysis of legal services statistics on settlements and of litigation files) | OPC recommendations advanced before the Courts are either settled to the satisfaction of the Commissioner or there is a court decision elaborating the law. | |
| Immediate Outcomes | ||
| The process to respond to inquiries and investigate complaints is effective and efficient. | Timeliness of OPC responses to inquiries and complaints. (Analysis of Office statistics on turnaround time and backlog status) | Note: the OPC is undergoing a major review of its inquiry and complaint investigation processes, based upon which service standards will be revised and serve as target. |
| The process to conduct audits and reviews is effective and efficient, including effective review of privacy impact assessments (PIAs) for new and existing government initiatives. | Extent to which audit recommendations are accepted and implemented over time. (Tracking and analysis of responses to audit reports) | 90% of audit recommendations are accepted fully by entities. Upon re-audit, two years after the initial report, action to implement has begun on 90% of recommendations |
| Proportion of audits and PIA reviews completed within planned times. (Review and analysis of statistics on audit and PIA project completion) | 50% of audits are completed within planned times and 50% of PIA reviews are completed within 90 days of receiving them (targets to be re-visited once OPC reaches full capacity) | |
| Responsiveness of (or feedback from) federal government departments and private sector organizations to the OPC advice relating to privacy rights and obligations and PIAs. (Tracking and analysis of the positive and negative feedback received following advice provided) | 75% of institutions and organizations are responsive to the OPC advice | |
| Financial Resources ($000) | Human Resources (FTEs) | |||||
|---|---|---|---|---|---|---|
| 2009-10 | 2010-11 | 2011-12 | 2009-10 | 2010-11 | 2011-12 | |
| 9,410 | 8,888 | 8,888 | 92 | 92 | 92 | |
Over the next three years, and more particularly in 2009-2010, the OPC will advance work towards the achievement of the above outcomes while also supporting our first corporate priority ("Continue to improve service delivery through focus and innovation") by pursuing the following activities:
- Eliminate the backlog of complaint investigation files by March 31, 2010.
- Complete the re-engineering of the inquiry and complaint investigation processes.
- Complete or initiate audits relating to national security and the protection of personal information, including:
- Privacy audits of the Financial Transactions Reports Analysis Centre of Canada, the Passenger Protect Program, Integrated Border Enforcement Teams, Public Safety, Canadian Air Transport Security Authority and Trusted Traveller Programs;
- Examination of wireless communication systems of federal departments and audit of Secure Channel operations;
- Audits in the private sector under PIPEDA where particular problems in the protection of personal information have been recently identified; and
- Follow-up audits namely of the PIA function and Royal Canadian Mounted Police Exempt Data Bank operations.
- Continue to explore collaborative opportunities with provincial/territorial and international stakeholders through: resolutions at federal/provincial/territorial and International Data Protection Commissioners conferences and harmonized guidelines with provinces with substantially similar legislation.
Lessons learned: While human error still accounts for the bulk of privacy complaints, the future environment of privacy is shaped by global information flows and emerging technologies. This new environment creates unique and complex challenges for OPC officers that are called upon to lead consultation groups to facilitate the development of privacy guidelines and principles.
In addition, we have learned that well aimed and professionally done audits and reviews of privacy impact assessments can have considerable impact on the systems and practices of organizations. The amount of attention organizations give to their privacy management framework is critical for ensuring compliance with law and promoting best practices. Our work has and should continue as an instrument for strengthening frameworks and making things better than they are.
Benefits for Canadians from this Program Activity
Canadians depend on the investigation services delivered by the OPC as the last line of defence for the protection of their privacy rights. Equally, audits and PIA reviews seek to improve management and accountability for privacy in public and private sector organizations. In causing improvements to organizational systems and practices, the privacy rights of individuals are better assured not only today but for future generations.
2.3 Program Activity 2: Research and Policy Development
Activity Description
The OPC serves as a centre of expertise on emerging privacy issues in Canada and abroad by researching trends and technological developments, monitoring legislative and regulatory initiatives, providing legal, policy and technical analyses on key issues, and developing policy positions that advance the protection of privacy rights. An important part of the work done involves supporting the Commissioner and senior officials in providing advice to Parliament on potential privacy implications of proposed legislation, government programs and private sector initiatives.
| Expected Results | Performance Indicators (Performance Measurement Strategy) |
Targets |
|---|---|---|
| Intermediate Outcome | ||
| Parliamentarians and key stakeholders have access to clear, relevant information, and timely and objective advice about the privacy implications of evolving legislation, regulations and policies. | Parliament and sponsoring departments have been provided with the OPC views on the privacy implications of relevant laws, regulations and policies in progress. (Tracking and analysis of data on legislative analyses, letters, testimony, other sources of feedback from stakeholders) | Where appropriate, OPC views on the privacy implications of legislation, regulations and policies are made available to stakeholders in a timely fashion |
| Immediate Outcomes | ||
| The work of Parliamentarians is supported by an effective capacity to identify privacy issues, and to develop policy positions for the federal public and private sectors, which are respectful of privacy. | Idem | Idem |
| Knowledge about systemic privacy issues in Canada and abroad is enhanced through information exchange and research, with a view to advance privacy files of common interest to stakeholders, to raise awareness and improve privacy management practices. | Stakeholders have had access to, and have considered, the OPC research products and outreach materials in their decision-making. (Review of progress reports against the three-year operational plans for the four priority privacy issues to extract evidence of impact on stakeholders from the OPC research products and outreach materials) | Initiatives under all four OPC priority privacy issues have involved the relevant stakeholders and there is documented evidence demonstrating that they were impacted by the OPC research products and outreach materials |
| Financial Resources ($000) | Human Resources (FTEs) | |||||
|---|---|---|---|---|---|---|
| 2009-10 | 2010-11 | 2011-12 | 2009-10 | 2010-11 | 2011-12 | |
| 4,288 | 4,598 | 4,598 | 17 | 17 | 17 | |
Over the next three years, and more particularly in 2009-2010, the OPC will advance work towards the achievement of the above outcomes while also supporting our third and fourth corporate priorities ("Strategically advance global privacy protection for Canadians" and "Support Canadians, organizations and institutions to make informed privacy choices") by pursuing the following activities:
- Increase formal and informal ties with Canadian and international privacy stakeholders, including advocacy groups, professional associations, academics and international organizations namely through active participation in various international fora3 and Federated States initiatives, and effective promotion of the development of collaborative agreements and processes to facilitate international cooperation in compliance and enforcement.
- Publish five PIPEDA guidance documents, revise the PIPEDA Compliance Framework and develop a companion Privacy Act Compliance Framework following the outcome of the re-engineering of OPC's inquiry and complaint investigation processes.
- Evaluate the impact, and renew the mandate, of the OPC Research Contributions program.
- Continue to contribute to the "Legal Corner" on the Internet to inform Canadians of relevant legal developments and what these mean for their day-to-day lives.
Lessons learned: The growth of an international economy that relies, to a large part, on the collection and processing of data is presenting ever larger challenges for privacy advocates. Increasingly, privacy regulators and data protection authorities are finding it necessary to share research and cooperate on policy development to ensure their citizens' rights continue to be protected. As well, OPC must identify privacy risks on the near horizon in order to be able to respond effectively and have impact prior to programs and services being implemented.
Benefits for Canadians from this Program Activity
With the help of effective and well-communicated research and outreach activities, Canadians will be able to evaluate the decisions they make every day, and measure the privacy risks they assume in the marketplace as a result. Equally, institutions and organizations will be better able to comply with their obligations in a more meaningful way. Joint and collaborative efforts with provincial/territorial and international counterparts mean more effective enforcement of privacy legislation.
An enhanced understanding of national and global privacy issues, and a strengthened capacity to address them more effectively is critical for Canada to be recognized as a leader in privacy protection and to positively influence the development of international privacy laws and cooperative agreements.
2.4 Program Activity 3: Public Outreach
Activity Description
The OPC delivers a number of public education and communications activities, including speaking engagements and special events, media relations, and the production and dissemination of promotional and educational material. Through public outreach activities, individuals have access to information about privacy and personal data protection that enable them to protect themselves and exercise their rights. The activities also allow organizations to understand their obligations under federal privacy legislation.
| Expected Results | Performance Indicators (Performance Measurement Strategy) |
Targets |
|---|---|---|
| Intermediate Outcomes | ||
| Individuals have relevant information about privacy rights and are enabled to guard against threats to their personal information. | Reach of target audience with OPC public education and communication activities. (Analysis of reach based on: media monitoring, hits on OPC web site and blogs, audience size of speeches and events, distribution of materials, etc.) | 100 citations of OPC officials on salient privacy issues per year; at least 100,000 hits on OPC web site and 10 comments on OPC blogs per month; at least three speeches/events per month, reaching a minimum of 1000 persons in total; at least 1000 publications sent per year; and an average of one news release per month. |
| Federal government institutions and private sector organizations understand their obligations under federal privacy legislations. | Responsiveness of (or feedback from) federal government departments and private sector organizations to the OPC advice relating to privacy rights and obligations and PIAs. (Tracking and analysis of the positive and negative feedback received following advice provided) | 75% of institutions and organizations are responsive to the OPC advice |
| OPC had a positive influence on the development of relevant jurisprudence and policy resulting in clearer legal obligations of government institutions and private sector organizations. (Comparison of OPC arguments/ submissions, with the final decisions of the Court or final recommendations of the relevant Commission of inquiry) | Courts and Commissioners of Inquiry have heard and considered OPC arguments | |
| Immediate Outcomes | ||
| Individuals receive and have easy access to relevant information about privacy and personal data protection, enabling them to better protect themselves and exercise their rights. | Reach of target audience with OPC public education and communication activities. (Analysis of reach based on: media monitoring, hits on OPC web site and blogs, audience size of speeches and events, distribution of materials, etc.) | 100 citations of OPC officials on salient privacy issues per year; at least 100,000 hits on OPC web site and 10 comments on OPC blogs per month; at least three speeches/events per month, reaching a minimum of 1000 persons in total; at least 1000 publications sent per year; and an average of one news release per month. |
| Extent to which individuals know about the existence/role of OPC, understand their privacy rights, and feel they have enough information about threats to privacy. (Public opinion polls and other research activities) | At least 15-20% of Canadians have awareness of the OPC; at least 15-20% of Canadians have an "average" level of understanding of their privacy rights; and at least 35-40% of Canadians have some level of awareness of the privacy threats posed by new technologies | |
| Federal government institutions and private sector organizations receive useful guidance on privacy rights and obligations, contributing to better understanding and enhanced compliance. | Reach of organizations with OPC policy positions, promotional activities and promulgation of best practices. (Analysis of reach based on: media monitoring, hits on OPC web site, audience size of speeches and events, distribution of materials, namely those designed and disseminated specifically for organizations, and consultations with key stakeholders) | 100 citations of OPC officials on salient privacy issues per year; at least 100,000 hits on OPC web site and 10 comments on OPC blogs per month; at least three speeches/events per month, reaching a minimum of 1000 persons in total; at least 1000 publications sent per year; and an average of one news release per month. |
| Financial Resources ($000) | Human Resources (FTEs) | |||||
|---|---|---|---|---|---|---|
| 2009-10 | 2010-11 | 2011-12 | 2009-10 | 2010-11 | 2011-12 | |
| 3,585 | 3,585 | 3,585 | 23 | 23 | 23 | |
Over the next three years, and more particularly in 2009-2010, the OPC will advance work towards the achievement of the above outcomes while also supporting our fourth corporate priority ("Support Canadians, organizations and institutions to make informed privacy choices") by pursuing the following activities:
- Increase efforts to provide information and tools to specific markets, such as youth, small business and disadvantaged communities.
- Continue implementation of plans to expand the OPC's partnerships with provincial/territorial privacy commissioners and other organizations in selected provinces across Canada, namely to identify opportunities for collaborative outreach and public education campaigns.
- Continue to conduct research into levels of awareness, needs and expectations of Canadians with respect to their privacy rights.
- Continue to develop, produce and disseminate key guidance, in a variety of formats and settings, to help Canadians understand and exercise their privacy rights and to assist organizations understand their responsibilities with respect to the protection of personal information under federal privacy laws.
Lessons learned: Canadians require communications and public education tools and materials specifically tailored to their personal circumstances. The OPC must continue to target its campaigns and outreach activities to address the questions and challenges encountered by individual Canadians.
Benefits for Canadians from this Program Activity
The Privacy Commissioner of Canada has a mandate to raise awareness of rights and obligations under privacy laws. The OPC work under this program activity directly benefits individuals. By having a more in-depth understanding of Canadians' views and concerns with respect to their personal information, the OPC is in a better position to educate individuals about their rights so they may make informed choices with respect to their personal information protection. As well, by helping organizations understand their responsibilities under federal privacy laws, and by encouraging them to better protect the personal information in their care, Canadians ultimately win, with enhanced privacy protection.
2.5 Program Activity 4: Internal Services
Activity Description
Internal Services are groups of related activities and resources that are administered to support the needs of programs and other corporate obligations of an organization. As a small entity, the OPC's internal services include two sub-activities: governance and management support, and resource management services (which also incorporate asset management services). Given the specific mandate of the OPC, communications services are not included in Internal Services but rather form part of Program Activity 3 – Public Outreach. Equally, legal services are excluded from Internal Services at OPC given the legislated requirement to pursue court action under the two federal privacy laws as appropriate. Hence legal services form part of Program Activity 1 – Compliance Activities and Program Activity 2 – Research and Policy Development.
| Expected Results | Performance Indicators (Performance Measurement Strategy) |
Target |
|---|---|---|
| The OPC achieves a standard of organizational excellence, and managers and staff apply sound business management practices. | Ratings against the Management Accountability Framework (MAF). (Review of results to the biennial MAF self-assessment exercise and annual progress reports) | Strong or acceptable rating on 70% of MAF areas of management |
Internal Services Program Activity
| Financial Resources ($000) | Human Resources (FTEs) | |||||
|---|---|---|---|---|---|---|
| 2009-10 | 2010-11 | 2011-12 | 2009-10 | 2010-11 | 2011-12 | |
| 5,040 | 4,879 | 4,879 | 46 | 46 | 46 | |
Over the next three years, and more particularly in 2009-2010, the OPC will advance work towards the achievement of the above outcomes while also supporting our fifth corporate priority ("Enhance and sustain the organizational capacity") by pursuing the following activities:
- Continue implementation of the OPC Integrated Business and Human Resources Plan 2008-2011 using innovative approaches and solutions to capacity challenges.
- Implement the second year commitments of the 2008 Business Case, particularly addressing issues of capacity in our compliance activities. This includes integrating approximately 20 new inquiry and investigation staff and providing the required training.
- Complete implementation of the Case Management System and other IM/IT initiatives to support the streamlining of the investigation and other processes.
- Have a fully functional internal audit function by April 1, 2009 as per TBS Policy on Internal Audit.
Lessons learned: In the last year, the OPC has recognized the elevated level of effort that is required to implement the new Case Management System and other IM/IT initiatives. Fortunately, we benefitted from the active collaboration and effort of all staff to advance the work towards the streamlining of our processes and systems. In addition, in 2008-2009 the OPC approved an Integrated Business and Human Resources Plan for 2008-2011, which includes the necessary human resources support that the OPC requires to achieve its business goals in a more systematic and formalized manner.
