ARCHIVED - Office of the Privacy Commissioner of Canada

This page has been archived.

2009-10
Report on Plans and Priorities

Office of the Privacy Commissioner of Canada

The original version was signed by
The Honourable Robert D. Nicholson, P.C., Q.C., M.P.
Minister of Justice and Attorney General of Canada

---

Table of Contents

• Message from the Privacy Commissioner of Canada
• Section I: Overview
  • 1.1 Summary Information
  • 1.2 Planning Summary
• Section II: Analysis of Program Activities
  • 2.1 Strategic Outcome
  • 2.2 Program Activity 1: Compliance Activities
  • 2.3 Program Activity 2: Research and Policy Development
  • 2.4 Program Activity 3: Public Outreach
  • 2.5 Program Activity 4: Internal Services
• Section III: Supplementary Information
  • 3.1 List of Tables
  • 3.2 Other Items of Interest

Message from the Privacy Commissioner of Canada

I am pleased to present this 2009-2010 Report on Plans and Priorities, which sets out the strategic directions, priorities, expected results and spending estimates for the Office of the Privacy Commissioner of Canada (OPC) for the coming fiscal year.

As we were preparing this Report, I marked an important anniversary – five years as Privacy Commissioner. Anniversaries are a time for reflection, and what stands out as I look back over the last five years is how far my Office has come.

As our past Reports on Plans and Priorities have indicated, in addition to focusing on activities related to the full implementation of Personal Information Protection and Electronic Documents Act (PIPEDA), the key focus of my first three years as Commissioner was on getting our house back in order after a tumultuous period of administrative, financial and organizational crises. During that time, we made tremendous progress on strengthening the management and financial framework of the OPC.

The fourth and fifth years were about consolidation – our rebuilt Office emerged as an effective organization. Our focus shifted back to where it should be: fulfilling our mandate to protect the privacy rights of all Canadians.

The coming final two years of my mandate will be even more focused on action. We live in an unprecedented period of transformation for privacy and the challenges we face as Canada's privacy guardian are enormous and ever-changing. New information technologies and new implications of 9-11 are creating potent and novel threats to privacy. Our Office will take an even more innovative and focused approach in addressing these evolving issues.

Last year, the OPC had identified five corporate priorities to give focus to its activities and most effectively achieve its Strategic Outcome of protecting the privacy rights of individuals. For the planning period of this Report on Plans and Priorities, the management team ratified last year's priorities with slight revisions to keep with the changing privacy world and organizational challenges. 

The five corporate priorities for 2009-2010 are as follows:

• Continue to improve service delivery through focus and innovation;
• Provide leadership to advance four priority privacy issues (information technology, national security, identity integrity and protection, genetic information);
• Strategically advance global privacy protection for Canadians;
• Support Canadians, organizations and institutions to make informed privacy decisions; and
• Enhance and sustain the organizational capacity.

While the challenges we face in our day to day work are great, I am proud that the OPC has such a talented and creative team dedicated to tenaciously working to fulfill the vital mandate which Parliament has entrusted in our Office.

 

(Original signed by)

Jennifer Stoddart
Privacy Commissioner of Canada

Section I: Overview

1.1 Summary Information

Raison d'être

The mandate of the Office of the Privacy Commissioner of Canada is to oversee compliance with both the Privacy Act, which covers the personal information-handling practices of federal government departments and agencies, and the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's private sector privacy law. The mission of the Office is to protect and promote the privacy rights of individuals¹.

Responsibilities

The Privacy Commissioner of Canada, Jennifer Stoddart, is an Officer of Parliament who reports directly to the House of Commons and the Senate. The Commissioner is an advocate for the privacy rights of Canadians and her powers include:

• Investigating complaints, conducting audits and pursuing court action under two federal laws;
• Publicly reporting on the personal information-handling practices of public and private sector organizations;
• Supporting, undertaking and publishing research into privacy issues; and
• Promoting public awareness and understanding of privacy issues.

The Commissioner works independently from any other part of the government to investigate complaints from individuals with respect to the federal public sector and the private sector. We focus on resolving complaints through negotiation and persuasion, using mediation and conciliation if appropriate. However, if voluntary co-operation is not forthcoming, the Commissioner has the power to summon witnesses, administer oaths and compel the production of evidence. In cases that remain unresolved, particularly under PIPEDA, the Commissioner may take the matter to Federal Court and seek a court order to rectify the situation.

Strategic Outcome and Program Activity Architecture (PAA)

To pursue its mandate effectively, the OPC works towards the achievement of a single Strategic Outcome: that the privacy rights of individuals are protected.  The Office's architecture of program activities for making continued progress to protect privacy on behalf of Canadians is composed of three operational activities and one management activity as follows (the PAA diagram below presents information at the program activity level):

Strategic Outcome

The privacy rights of individuals are protected.

Program Activity
1. Compliance Activities
2. Research and Policy Development
3. Public Outreach
4. Internal Services

Alignment of PAA to Government of Canada Outcomes

The Privacy Commissioner is an Officer of Parliament who reports directly to Parliament. The Strategic Outcome of, and the expected results from, her Office are detailed in Section 2 of this Report on Plans and Priorities.

1.2 Planning Summary

The following two tables present a summary of the total planned financial and human resources for the OPC over the next three fiscal years.

Financial Resources ($000)

2008-09	2009-10	2010-11
22,323	21,950	21,950

Human Resources (FTEs*)

2008-09	2009-10	2010-11
178	178	178

* FTE: Full-Time Equivalent

Contribution of Priorities to the Strategic Outcome

The OPC has a single Strategic Outcome (SO 1): The privacy rights of individuals are protected. The table below describes how each corporate priority contributes to the Strategic Outcome and what the OPC plans to do in 2009-2010 to achieve or make progress toward each priority.

Operational Priorities	Type2	Link to Strategic Outcome	Description
Continue to improve service delivery through focus and innovation	Ongoing	SO 1	This has been, and continues to be, the most important priority for the OPC, as much as it is a challenge given the ever-increasing demand for privacy protection coupled with the difficulty of recruiting experienced investigators and auditors. The OPC is committed to: Eliminating the backlog of complaint investigation files Reviewing work processes to increase efficiency through introduction and implementation of alternative approaches to investigations, audits, privacy impact assessment reviews, and other activities Exploring collaborative opportunities with provincial/territorial and international counterparts.
Provide leadership to advance four priority privacy issues (information technology, national security, identity integrity and protection, genetic information)	Previous	SO 1	Last year, in an effort to be more strategic in its allocation of resources and to achieve greater impact, the OPC designated four horizontal priority privacy issues to help guide the Office over the next few years and developed a three-year plan to advance each issue. Over the period of this RPP, the OPC will: Implement, and monitor progress on, the approved plan to advance each of the four priority privacy issues.
Strategically advance global privacy protection for Canadians	Previous	SO 1	Businesses, particularly in the online context, increasingly operate transnationally. The OPC will continue to work with international stakeholders to advance global privacy protection for Canadians. More specifically, the OPC will: Develop and sustain partnerships with data protection authorities, international associations, global corporations, and other regulators (such as the US Federal Trade Commission) Share knowledge about privacy standards and other privacy issues and practices with international jurisdictions and partners.
Support Canadians, organizations and institutions to make informed privacy choices	Previous	SO 1	The OPC will continue to provide Canadians with information and tools to understand and protect their rights. The Office will also work with organizations and institutions so they understand their privacy obligations and comply with applicable legislation. The OPC will: Continue to identify issues of privacy risk and expand public awareness to key audiences Work with partners to develop and deliver outreach programs.

Management Priority	Type	Link to Strategic Outcome	Description
Enhance and sustain the organizational capacity	Previous	SO 1	Having obtained increased funding to meet a greater demand, the OPC must continue efforts to build the required capacity to support its activities directed to privacy protection and promotion. The Office's focus relating to internal services will be to: Identify and implement innovative approaches and solutions to capacity challenges (i.e., major recruitment in core functions, privacy training to new investigators and other staff, developmental hiring, interchanges, enhanced departmental orientation) Develop and use robust technology and integrative tools to increase knowledge and information sharing as well as collaboration between OPC branches, hence enhancing capacity.

Risk Analysis

The strategic context and operating environment of the OPC are characterized by external and internal factors and risks that dictate the choice of our corporate priorities, affect our plans and performance, and drive our decision-making. This section briefly presents our particular environment.

Privacy regulators, whether national, provincial, territorial or international, now find themselves facing similar operational environments. Our traditional role as the guardians of personal privacy is well established in legislation, defined by clear guidelines and reinforced by a history of legal precedents. At the same time, challenges to the conventional interpretation of personal privacy appear to increase with every new development in technology.

Whether as a result of new and powerful consumer products that encourage individuals to enter, store and share data on a range of interests, obsessions and personal details, or the creation and rapid application of business products and processes that can easily collect, analyze and commercialize this data, it appears that individuals are making decisions that may, in fact, erode the general right to personal privacy and the protection of their personal data.

Organizations like ours are trying to understand why Canadians are making these decisions. Have they become resigned to less privacy as a result of the rash of invasive security measures imposed over the past seven years?  Does the growing popularity of community-building tools – like online forums, social networks and micro-blogging services – encourage individuals to share more personal information with little consideration for the short term and long term implications of their behaviour?  Canadians appear willing to trade a certain amount of information about their background, their preferences and their intentions for relatively little reward: is there a limit to the information they will trade?

At the same time, businesses are learning to apply technology in more effective and efficient means. They are using sophisticated data collection and analysis tools to identify their customers and target particular customer segments. The level of detail available about individuals who regularly use online services should be staggering to most Canadians.

The ready availability of bandwidth, inexpensive computing power and all this data is fuelling the growth of global online service firms. As Canadians are encouraged to use online services, their personal information may rapidly find its way into files and data servers in countries with less robust privacy protection regimes.

Faced with these challenges, privacy regulators are dedicating more of their resources to working in concert with their international colleagues. Together, they are developing global standards in data protection, identity management and the reporting of data breaches.  They are identifying jurisdictions with weaker privacy protections, and are working with global firms to ensure privacy protection meets the same high standard around the world – not the lowest common denominator. These cooperative efforts are especially important in a turbulent economic environment where private industry and public sector organizations might be tempted to concentrate on other priorities, to the detriment of privacy and data protection.

In order to be successful and deliver on its expected results, the OPC manages risks to its operations through implementing controls and mitigation strategies. At present, the three most critical risks faced by the Office are as follows:

First, considering that business demands exceed the present the OPC capacity, there is a risk that the Office could not meet its legislative and mandated requirements or could not deliver on its corporate priorities and business activities as planned. The OPC has been struggling for some time with a significant backlog of investigations and privacy impact assessment (PIA) reviews. The OPC mitigates this risk through a major initiative to review and streamline its work processes to increase efficiency. In 2009-2010, we will be in the final stages of development and full implementation of a new Case Management System scheduled for December 2009, which will lead to re-engineering of processes to reflect a more streamlined approach to respond to inquiries and complaint investigations and will help reduce some of our capacity challenges. As well, the OPC focuses efforts on four distinct priority issues to maximize our impact, as opposed to always trying to address any and all privacy issues, recognizing their proliferation.

Capacity challenges are exacerbated by a marketplace characterized by a restricted pool of specialized, investigative and audit skills, as well as lengthy staffing processes. While some of these challenges are common throughout the federal public service, they nevertheless affect the human resources situation at the OPC. In 2008-2009, the OPC approved a revised Integrated Business and Human Resources Plan, which includes a resourcing strategy identifying plans and priorities for the next three years, namely to address capacity and retention challenges. We also make effective use of alternative approaches to staffing (terms, contractors, students). The OPC received additional funding through a business case approved in 2008-2009 and is now hiring new staff; however, the scarcity of investigative skills represents a continuing risk.

Second, there is a risk of privacy breaches to the OPC information and data management, which could potentially come from an inconsistent application of, internal security procedures or improper system architecture and roles-based access to OPC systems. Since the OPC's mandate is to protect the privacy rights of individuals, it must lead with the protection of its own information and data. We have a number of IT security controls in place such as: compliance with the Management of Information Technology Security (MITS) standards and the new Government Policy for IT Security, annual threat and risk assessments (TRAs) and quick action on any identified shortcomings, and due diligence in the handling of access to information and privacy requests. Nevertheless, the risk remains as for any organization considering our era's dependency on technology to manage operations and exchange information.

Third is the fact that the Privacy Act is not up-to-date and does not offer sufficient provision to protect individuals' personal information held or handled by federal government departments and agencies. The Act was enacted in 1983 when there were no personal computers, no Internet, no cell phones, no geo-positioning systems, let alone biometrics and radio frequency identification devices (RFIDs) chips or nanotechnology. It was crafted in the era of reel-to-reel computer tapes and paper files in filing cabinets, when transborder data flow almost entirely was achieved through shipping goods, tapes or paper, not digital bits. This important risk inherently reduces the OPC's ability to influence the protection of individuals' privacy rights.

The OPC has pointed out on many occasions that the Privacy Act is long overdue for a fundamental reform. We will continue to advocate for Privacy Act reform by engaging Parliament, as well as encouraging federal government institutions to adopt leading practices to respect the privacy rights of individuals and to protect their personal information. We do this through Parliamentary appearances, speeches, media relations activities, and other communications activities, and we work with Treasury Board Secretariat on the renewal of policies and guidance for federal institutions as it relates to privacy. In the spring of 2008, the House of Commons Standing Committee on Access to Information, Privacy and Ethics commenced a review of the Privacy Act. The Privacy Commissioner proposed a list of 10 "quick fixes" when she appeared before the Committee in April 2008 as a first step in modernizing the legislation while we wait for comprehensive reform.  The Committee heard from a number of witnesses and our Office hopes that the Committee will return to this work when Parliament reconvenes. (www.privcom.gc.ca/information/ar/200708/200708_pa_e.asp).

Expenditure Profile

In 2009-2010, the OPC plans to spend $22,323,597 to make progress on its five corporate priorities, meet the expected results of its program activities, and contribute to its Strategic Outcome.

Spending Trend From 2005-2006 To 2011-2012

The figure below illustrates the OPC's spending trend over an eight-year period.

The above spending trend graph shows a steady increase in resources for the period 2005-2006 through to 2009-2010, then a slight drop in fiscal year 2010-2011 to a fixed state thereafter. The increased spending reflects resources sought by the OPC through two business cases, as submitted to the Parliamentary Panel on the Funding and Oversight of Officers of Parliament. First, in 2005, the OPC received approval to stabilize funding for PIPEDA and increase funding in support of our overall mandate. Second, in 2008, the OPC received approval to increase funding to: deliver programs in light of recent legislation (i.e., Federal Accountability Act, Proceeds of Crime (Money Laundering) Act), eliminate the backlog of privacy investigations, expand public outreach and establish an internal audit function. The increase in funding is phased-in over three fiscal years, 2008-2009, 2009-2010 and 2010-2011. The growth for 2008-2009 was $3.3M and for 2009-2010, it is $1.2M. The third year shows a slight reduction of funding of $0.4M, which is reflective of the sun-setting of the funding for the backlog elimination.

2009-2010 Allocation of Funding by Program Activity

The figure below displays the allocation of the OPC's funding by program activity for 2009-2010. A large portion of the OPC funding is allocated to Program Activity 1 – Compliance Activities, which include the Office's main program delivery mechanisms, namely complaint investigations, responses to inquiries, audits, and privacy impact assessment reviews.

Voted and Statutory Items

The table illustrates the way in which Parliament approved the OPC's resources, and shows the changes in resources derived from the supplementary estimates and other authorities, as well as how funds were spent.

Voted and Statutory Items displayed in the Main Estimates
($000)

Vote # or Statutory Item	Truncated Vote or Statutory Wording	2008-09 Main Estimates	2009-10 Main Estimates
45	Program expenditures	15,898	20,101
(S)	Contributions to employee benefit plans	1,929	2,222
Total		17,827	22,323

Section II: Analysis of Program Activities

2.1 Strategic Outcome

All of the OPC efforts and activities are directed towards the achievement of its single Strategic Outcome to protect the privacy rights of individuals. That said, the OPC is one of several advocates and catalysts that contribute to this goal, with the Office specifically having a lead role. This is to clarify its specific contribution as having a lead role to influence those that handle Canadians' personal information, so that they respect the privacy rights of individuals and protect their personal information. Other advocates and catalysts include: provincial and territorial privacy commissioners, international data protection authorities, privacy advocacy groups, chief privacy officers, professional associations, consumer representatives, academics and international organizations as well as Parliamentary Committees and government departments and agencies.

Strategic Outcome

The privacy rights of individuals are protected.

Expected Result	Performance Indicator	Target
Ultimate Outcome for Canadians
The OPC plays a lead role in influencing federal government institutions and private sector organizations to respect the privacy rights of individuals and protect their personal information.	Extent and direction of change in the privacy practices of federal government institutions and private sector organizations.	Target to be established once a baseline is set in 2009-2010 (Note: baseline to be updated approximately every five years; reporting on this indicator and target to start in 2010-2011).

Performance Measurement Strategy

This "umbrella" indicator" will result in a narrative based on performance information generated from several indicators under the OPC Program Activities (PA) as well as other sources of information, including (but not limited to): Extent to which investigation and audit recommendations are accepted and implemented over time (Refer to PA 1); Parliament and sponsoring departments have heard and considered the OPC views on the privacy implications of relevant laws, regulations and policies in progress (Refer to PA 2); Extent to which individuals know about the existence/role of the OPC, understand their privacy rights, and feel they have enough information about threats to privacy (Refer to PA 3); Retrospective analysis of priority privacy issues prepared for, and presented via, the OPC Annual Reports; Proportion of PIAs reviewed by the OPC that were of good quality and that required little comments; and actual implementation of a sample of "significant" government initiatives for which PIA recommendations were made.

The activities carried out to support all OPC Program Activities will contribute to the Strategic Outcome. In 2009-2010, we will continue to focus our investigative, audit, research, outreach and other activities and be guided by four priority privacy issues as per our second corporate priority: "Provide leadership to advance issues relating to: information technology, national security, identity integrity and protection, and genetic information."

The following sections describe the OPC's program activities and identify for each one: the expected results, performance indicators, targets and performance measurement strategy, financial and human resources, planning highlights for the planning period and benefits to Canadians. Note that some performance indicators published in last year's Report on Plans and Priorities have been revised to provide a more accurate or reliable performance information for decision-making and reporting.

2.2 Program Activity 1: Compliance Activities

Activity Description

The OPC is responsible for investigating complaints and responding to inquiries received from individuals and organizations that contact the OPC for advice and assistance on a wide range of privacy-related issues. The OPC also assesses, through audits and reviews, how well organizations are complying with requirements set out in the two federal laws and provides recommendations on privacy impact assessments (PIAs) pursuant to the Treasury Board Secretariat policy. This activity is supported by a legal team that provides specialized legal advice and litigation support, and a research team with senior technical and risk assessment support.

Program Activity 1: Compliance Activities

Expected Results	Performance Indicators	Targets
Intermediate Outcomes
Individuals receive effective responses to their inquiries and complaints.	Timeliness of OPC responses to inquiries and complaints. (Analysis of Office statistics on turnaround time and backlog status)	Note: the OPC is undergoing a major review of its inquiry and complaint investigation processes, based upon which service standards will be revised and serve as targets.
Federal government institutions and private sector organizations meet their obligations under federal privacy legislation and implement modern practices of personal information protection.	Extent to which investigation and audit recommendations are accepted and implemented over time. (Tracking and analysis of responses to investigation and audit reports)	90% of investigation recommendations are accepted and implemented. 90% of audit recommendations are accepted fully by entities. Upon re-audit, two years after the initial report, action to implement has begun on 90% of recommendations
	OPC recommendations that are not resolved through the investigation process are advanced before the Courts, where possible. (Review and analysis of legal services statistics on settlements and of litigation files)	OPC recommendations advanced before the Courts are either settled to the satisfaction of the Commissioner or there is a court decision elaborating the law.
Immediate Outcomes
The process to respond to inquiries and investigate complaints is effective and efficient.	Timeliness of OPC responses to inquiries and complaints. (Analysis of Office statistics on turnaround time and backlog status)	Note: the OPC is undergoing a major review of its inquiry and complaint investigation processes, based upon which service standards will be revised and serve as target.
The process to conduct audits and reviews is effective and efficient, including effective review of privacy impact assessments (PIAs) for new and existing government initiatives.	Extent to which audit recommendations are accepted and implemented over time. (Tracking and analysis of responses to audit reports)	90% of audit recommendations are accepted fully by entities. Upon re-audit, two years after the initial report, action to implement has begun on 90% of recommendations
	Proportion of audits and PIA reviews completed within planned times. (Review and analysis of statistics on audit and PIA project completion)	50% of audits are completed within planned times and 50% of PIA reviews are completed within 90 days of receiving them (targets to be re-visited once OPC reaches full capacity)
	Responsiveness of (or feedback from) federal government departments and private sector organizations to the OPC advice relating to privacy rights and obligations and PIAs. (Tracking and analysis of the positive and negative feedback received following advice provided)	75% of institutions and organizations are responsive to the OPC advice

Financial Resources ($000)				Human Resources (FTEs)
2009-10	2010-11	2011-12		2009-10	2010-11	2011-12
9,410	8,888	8,888		92	92	92

Lessons learned:  While human error still accounts for the bulk of privacy complaints, the future environment of privacy is shaped by global information flows and emerging technologies. This new environment creates unique and complex challenges for OPC officers that are called upon to lead consultation groups to facilitate the development of privacy guidelines and principles.

In addition, we have learned that well aimed and professionally done audits and reviews of privacy impact assessments can have considerable impact on the systems and practices of organizations. The amount of attention organizations give to their privacy management framework is critical for ensuring compliance with law and promoting best practices. Our work has and should continue as an instrument for strengthening frameworks and making things better than they are.

Benefits for Canadians from this Program Activity

Canadians depend on the investigation services delivered by the OPC as the last line of defence for the protection of their privacy rights. Equally, audits and PIA reviews seek to improve management and accountability for privacy in public and private sector organizations. In causing improvements to organizational systems and practices, the privacy rights of individuals are better assured not only today but for future generations.

2.3 Program Activity 2: Research and Policy Development

Activity Description

The OPC serves as a centre of expertise on emerging privacy issues in Canada and abroad by researching trends and technological developments, monitoring legislative and regulatory initiatives, providing legal, policy and technical analyses on key issues, and developing policy positions that advance the protection of privacy rights. An important part of the work done involves supporting the Commissioner and senior officials in providing advice to Parliament on potential privacy implications of proposed legislation, government programs and private sector initiatives.

Expected Results	Performance Indicators (Performance Measurement Strategy)	Targets
Intermediate Outcome
Parliamentarians and key stakeholders have access to clear, relevant information, and timely and objective advice about the privacy implications of evolving legislation, regulations and policies.	Parliament and sponsoring departments have been provided with the OPC views on the privacy implications of relevant laws, regulations and policies in progress. (Tracking and analysis of data on legislative analyses, letters, testimony, other sources of feedback from stakeholders)	Where appropriate, OPC views on the privacy implications of legislation, regulations and policies are made available to stakeholders in a timely fashion
Immediate Outcomes
The work of Parliamentarians is supported by an effective capacity to identify privacy issues, and to develop policy positions for the federal public and private sectors, which are respectful of privacy.	Idem	Idem
Knowledge about systemic privacy issues in Canada and abroad is enhanced through information exchange and research, with a view to advance privacy files of common interest to stakeholders, to raise awareness and improve privacy management practices.	Stakeholders have had access to, and have considered, the OPC research products and outreach materials in their decision-making. (Review of progress reports against the three-year operational plans for the four priority privacy issues to extract evidence of impact on stakeholders from the OPC research products and outreach materials)	Initiatives under all four OPC priority privacy issues have involved the relevant stakeholders and there is documented evidence demonstrating that they were impacted by the OPC research products and outreach materials

Financial Resources ($000)				Human Resources (FTEs)
2009-10	2010-11	2011-12		2009-10	2010-11	2011-12
4,288	4,598	4,598		17	17	17

Lessons learned: The growth of an international economy that relies, to a large part, on the collection and processing of data is presenting ever larger challenges for privacy advocates. Increasingly, privacy regulators and data protection authorities are finding it necessary to share research and cooperate on policy development to ensure their citizens' rights continue to be protected. As well, OPC must identify privacy risks on the near horizon in order to be able to respond effectively and have impact prior to programs and services being implemented.

Benefits for Canadians from this Program Activity

With the help of effective and well-communicated research and outreach activities, Canadians will be able to evaluate the decisions they make every day, and measure the privacy risks they assume in the marketplace as a result. Equally, institutions and organizations will be better able to comply with their obligations in a more meaningful way. Joint and collaborative efforts with provincial/territorial and international counterparts mean more effective enforcement of privacy legislation.

An enhanced understanding of national and global privacy issues, and a strengthened capacity to address them more effectively is critical for Canada to be recognized as a leader in privacy protection and to positively influence the development of international privacy laws and cooperative agreements.

2.4 Program Activity 3: Public Outreach

Activity Description

The OPC delivers a number of public education and communications activities, including speaking engagements and special events, media relations, and the production and dissemination of promotional and educational material. Through public outreach activities, individuals have access to information about privacy and personal data protection that enable them to protect themselves and exercise their rights. The activities also allow organizations to understand their obligations under federal privacy legislation.

Expected Results	Performance Indicators (Performance Measurement Strategy)	Targets
Intermediate Outcomes
Individuals have relevant information about privacy rights and are enabled to guard against threats to their personal information.	Reach of target audience with OPC public education and communication activities. (Analysis of reach based on: media monitoring, hits on OPC web site and blogs, audience size of speeches and events, distribution of materials, etc.)	100 citations of OPC officials on salient privacy issues per year; at least 100,000 hits on OPC web site and 10 comments on OPC blogs per month; at least three speeches/events per month, reaching a minimum of 1000 persons in total; at least 1000 publications sent per year; and an average of one news release per month.
Federal government institutions and private sector organizations understand their obligations under federal privacy legislations.	Responsiveness of (or feedback from) federal government departments and private sector organizations to the OPC advice relating to privacy rights and obligations and PIAs. (Tracking and analysis of the positive and negative feedback received following advice provided)	75% of institutions and organizations are responsive to the OPC advice
	OPC had a positive influence on the development of relevant jurisprudence and policy resulting in clearer legal obligations of government institutions and private sector organizations. (Comparison of OPC arguments/ submissions, with the final decisions of the Court or final recommendations of the relevant Commission of inquiry)	Courts and Commissioners of Inquiry have heard and considered OPC arguments
Immediate Outcomes
Individuals receive and have easy access to relevant information about privacy and personal data protection, enabling them to better protect themselves and exercise their rights.	Reach of target audience with OPC public education and communication activities. (Analysis of reach based on: media monitoring, hits on OPC web site and blogs, audience size of speeches and events, distribution of materials, etc.)	100 citations of OPC officials on salient privacy issues per year; at least 100,000 hits on OPC web site and 10 comments on OPC blogs per month; at least three speeches/events per month, reaching a minimum of 1000 persons in total; at least 1000 publications sent per year; and an average of one news release per month.
	Extent to which individuals know about the existence/role of OPC, understand their privacy rights, and feel they have enough information about threats to privacy. (Public opinion polls and other research activities)	At least 15-20% of Canadians have awareness of the OPC; at least 15-20% of Canadians have an "average" level of understanding of their privacy rights; and at least 35-40% of Canadians have some level of awareness of the privacy threats posed by new technologies
Federal government institutions and private sector organizations receive useful guidance on privacy rights and obligations, contributing to better understanding and enhanced compliance.	Reach of organizations with OPC policy positions, promotional activities and promulgation of best practices. (Analysis of reach based on: media monitoring, hits on OPC web site, audience size of speeches and events, distribution of materials, namely those designed and disseminated specifically for organizations, and consultations with key stakeholders)	100 citations of OPC officials on salient privacy issues per year; at least 100,000 hits on OPC web site and 10 comments on OPC blogs per month; at least three speeches/events per month, reaching a minimum of 1000 persons in total; at least 1000 publications sent per year; and an average of one news release per month.

Financial Resources ($000)				Human Resources (FTEs)
2009-10	2010-11	2011-12		2009-10	2010-11	2011-12
3,585	3,585	3,585		23	23	23

Lessons learned: Canadians require communications and public education tools and materials specifically tailored to their personal circumstances. The OPC must continue to target its campaigns and outreach activities to address the questions and challenges encountered by individual Canadians.

Benefits for Canadians from this Program Activity

The Privacy Commissioner of Canada has a mandate to raise awareness of rights and obligations under privacy laws. The OPC work under this program activity directly benefits individuals. By having a more in-depth understanding of Canadians' views and concerns with respect to their personal information, the OPC is in a better position to educate individuals about their rights so they may make informed choices with respect to their personal information protection. As well, by helping organizations understand their responsibilities under federal privacy laws, and by encouraging them to better protect the personal information in their care, Canadians ultimately win, with enhanced privacy protection.

2.5 Program Activity 4: Internal Services

Activity Description

Internal Services are groups of related activities and resources that are administered to support the needs of programs and other corporate obligations of an organization. As a small entity, the OPC's internal services include two sub-activities: governance and management support, and resource management services (which also incorporate asset management services). Given the specific mandate of the OPC, communications services are not included in Internal Services but rather form part of Program Activity 3 – Public Outreach. Equally, legal services are excluded from Internal Services at OPC given the legislated requirement to pursue court action under the two federal privacy laws as appropriate. Hence legal services form part of Program Activity 1 – Compliance Activities and Program Activity 2 – Research and Policy Development.

Expected Results	Performance Indicators (Performance Measurement Strategy)	Target
The OPC achieves a standard of organizational excellence, and managers and staff apply sound business management practices.	Ratings against the Management Accountability Framework (MAF). (Review of results to the biennial MAF self-assessment exercise and annual progress reports)	Strong or acceptable rating on 70% of MAF areas of management

Internal Services Program Activity

Financial Resources ($000)				Human Resources (FTEs)
2009-10	2010-11	2011-12		2009-10	2010-11	2011-12
5,040	4,879	4,879		46	46	46

Lessons learned: In the last year, the OPC has recognized the elevated level of effort that is required to implement the new Case Management System and other IM/IT initiatives. Fortunately, we benefitted from the active collaboration and effort of all staff to advance the work towards the streamlining of our processes and systems. In addition, in 2008-2009 the OPC approved an Integrated Business and Human Resources Plan for 2008-2011, which includes the necessary human resources support that the OPC requires to achieve its business goals in a more systematic and formalized manner.

Section III: Supplementary Information

3.1 List of Tables

The following table is located on the Treasury Board Secretariat website:

Table 11 - Summary of Capital Spending by Program Activity

($000)

Program Activity	Forecast Spending 2008-09	Planned Spending 2009-10	Planned Spending 2010-11	Planned Spending 2012-12
Internal Services	550	550	800	550
Total	550	550	800	550

The increase of $250,000 in 2010-2011 is due to the evergreen replacement of main server infrastructure equipment every three years.

No other tables from the list included in the TBS RPP Instructions are of significance to the OPC at present.

3.2 Other Items of Interest

Legislation Administered by the Privacy Commissioner

Privacy Act	R.S.C. 1985, ch. P21, amended 1997, c.20, s. 55
Personal Information Protection and Electronic Documents Act	2000, c.5

Statutory Annual Reports, other Publications and Information

Statutory reports, publications and other information are available from the Office of the Privacy Commissioner of Canada, Ottawa, Canada K1A 1H3; tel.: (613) 995-8210 and on the OPC's Web site at www.privcom.gc.ca:

• Privacy Commissioner's annual reports
• Report on Plans and Priorities 2008-2009
• Performance Report to Parliament for the period ending March 31, 2007
• Your Privacy Rights: A Guide for Individuals to the Personal Information Protection and Electronic Documents Act
• Your Privacy Responsibilities: A Guide for Businesses and Organizations to the Personal Information Protection and Electronic Documents Act

---

¹ Reference is made to "individuals" in accordance with the legislation.

² Type is defined as follows: previous—previously committed to in the first or second fiscal year prior to this RPP; ongoing—committed to at least three fiscal years prior to this RPP; and new—newly committed to in this RPP.

³ (including Organization for Economic Cooperation and Development, Asia-Pacific Economic Cooperation, Asia-Pacific Privacy Authorities, La Francophonie community of data protection authorities)