Treasury Board of Canada Secretariat
www.tbs-sct.gc.ca
Common menu bar links
Breadcrumb Trail
ARCHIVED - Office of the Privacy Commissioner of Canada
This page has been archived.
Archived Content
Information identified as archived on the Web is for reference, research or recordkeeping purposes. It has not been altered or updated after the date of archiving. Web pages that are archived on the Web are not subject to the Government of Canada Web Standards. As per the Communications Policy of the Government of Canada, you can request alternate formats on the "Contact Us" page.
Section II: Analysis of Program Activities
2.1 Strategic Outcome
All OPC efforts and activities are directed towards achieving the Strategic Outcome, the protection of individuals' privacy rights. The Office plays a leadership role in encouraging organizations that handle Canadians' personal information to respect the privacy rights of individuals. Others who contribute to this mission include provincial and territorial privacy commissioners; international organizations, including data protection authorities; privacy advocacy groups; chief privacy officers; professional associations; consumer representatives; academics; Parliamentary committees, and government departments and agencies.
Strategic Outcome
The privacy rights of individuals are protected.
| Expected Result | Performance Indicator | Target |
|---|---|---|
| Ultimate Outcome for Canadians | ||
| The OPC plays a lead role in influencing federal government institutions and private-sector organizations to respect the privacy rights of individuals and protect their personal information. | Extent and direction of change in the privacy practices of federal government institutions and private-sector organizations. | Note: Baseline data being developed in 2009-2010 will be used to set a target level for this indicator during 2010-2011. The target will be published in the next RPP. |
| Performance Measurement Strategy |
|---|
This "umbrella indicator" is based on performance information generated from the following indicators used to measure the OPC Program Activities (PA):
|
The OPC has four Program Activities and each is presented in the subsections of Section II with the following structure: a description of the Program Activity; a table with information on the expected results for Canadians, the performance indicators and targets as well as the performance measurement strategy to be employed for the measurement; the allocated financial and human resources; the planning highlights with the major activities for 2010-2011, and the benefits for Canadians.
Over the past year, the OPC has revised some performance indicators and targets published in last year's Report on Plans and Priorities, in order to generate more useful and reliable performance information for decision-making and reporting. In addition, a few indicators are presented for the first time in this Report on Plans and Priorities as they were introduced in 2009-2010, this being the third year of a three-year implementation of the OPC performance measurement framework first developed in 2007-2008.
The planning highlights for each Program Activity are linked to one or more of the OPC's corporate priorities, as described in the next subsections. The second corporate priority ("Provide leadership to advance issues relating to: information technology, national security, identity integrity and protection, and genetic information") will continue to bring focus to all OPC investigative, audit, research, outreach and other activities. More specifically, in 2010-2011, the OPC will pursue this priority by carrying out and reporting on the following and other activities:
- Expand in-house monitoring and analysis of new technologies based in the public and private sectors, and their impact on the privacy protections of Canadians.
- Continue the development and distribution of tools and activities to help Canadian youth protect their privacy online.
- Acquire a more detailed understanding of how private- and public-sector entities are collecting and using the personal information of Canadians.
- Continue to give priority to Privacy Impact Assessments (PIAs) that have a national security focus. For example, the Office expects to receive PIAs dealing with information sharing among provincial, national and international law enforcement and security agencies.
- Follow-up on the Commissioner's recommendations in the audit of the RCMP exempt databanks (February 2008 - report available at http://www.priv.gc.ca/information/pub/arvr/rcmp_080213_e.pdf).
- Enhance working relationships with Parliament's national security-related committees and commissions to inform debate, decision-making and recommendations regarding privacy.
- Help organize two workshops to foster dialogue between the research community and federal policy-makers on policy issues arising from the increasing availability of genetic information.
- Continue developing in-house expertise, working towards the preparation of a policy paper on the privacy issues arising from the use of genetic information.
2.2 Program Activity 1: Compliance Activities
Activity Description
The OPC is responsible for investigating privacy-related complaints and responding to inquiries from individuals and organizations. Through audits and reviews, the OPC also assesses how well organizations are complying with requirements set out in the two federal privacy laws, and provides recommendations on Privacy Impact Assessments (PIAs) pursuant to Treasury Board Secretariat policy. This activity is supported by a legal team that provides specialized legal advice and litigation support, and a research team with senior technical and risk-assessment support.
| Expected Results | Performance Indicators (Performance Measurement Strategy) |
Targets |
|---|---|---|
| Intermediate Outcomes | ||
| Federal government institutions and private-sector organizations meet their obligations under federal privacy legislation and implement modern practices of personal information protection. | Extent to which investigation and audit recommendations are accepted and implemented over time (Tracking and analysis of responses to investigation and audit reports) |
90% of 'well-founded', 'resolved' and 'well-founded and resolved' investigation recommendations are accepted and implemented 90% of audit recommendations are accepted fully by entities Upon follow-up two years after the initial report, action to implement has begun on 90% of recommendations |
| Extent to which obligations are met through litigation (Review and analysis of litigation files and statistics on settlements) |
Legal obligations are met in 80% of cases, either through settlements to the satisfaction of the Commissioner or court-enforced judgments | |
| Immediate Outcomes | ||
| Individuals receive timely and effective responses to their inquiries and complaints. | Timeliness of OPC responses to inquiries and complaints (Analysis of Office statistics on turnaround time and backlog status) |
Note: the OPC just completed a major review of its inquiry and complaint investigation processes; service standards are being set and will serve as targets (to be published in the next RPP). |
| The privacy practices of federal government institutions (including Privacy Impact Assessments for new and existing government initiatives) and of private-sector organizations are audited and/or reviewed to determine their compliance with federal privacy legislation and policies. | Proportion of audits and PIA reviews completed within planned times (Review and analysis of statistics on audit and PIA project completion) | 50% of audits are completed within planned times and 50% of PIA reviews are completed within 90 days of initiation (targets to be revisited once the OPC reaches full capacity) |
| Responsiveness of (or feedback from) federal government departments and private-sector organizations to OPC advice relating to PIAs and interventions
(Tracking and analysis of responses to PIAs and interventions) |
75% of institutions and organizations are responsive to OPC advice | |
| Adjusted Planned Spending | 2010-2011 | 2011-2012 | 2012-2013 |
|---|---|---|---|
| Financial Resources ($000) | 9,198 | 10,152 | 10,152 |
| Human Resources (FTEs) | 88 | 90 | 90 |
Planning Highlights for Program Activity 1
Over the next three years, the OPC will work toward the above Compliance Activities outcomes, while also supporting its first corporate priority - "Redefine service delivery through innovation to maximize results". In 2010-2011, therefore, the OPC will supplement its usual activities with the following initiatives:
- Refine the inquiries and complaints intake function to more accurately assess potential complaints and assign resources proportionately and early in the process.
- Share strategic intelligence about emerging privacy issues and trends with other areas of the Office.
- Increase the number and/or scope of investigations on systemic privacy issues to identify systemic solutions.
- Implement a quality-assurance program for the complaints-resolution process, in order to validate the re-engineering principles applied recently to streamline the process and to provide a vehicle for ongoing service delivery improvement.
- Enhance the strategic planning of audits by basing them on thorough risk analyses and improve the efficiency of the audit function with new standardized audit methodology.
- Conduct audits in the public sector on the use of wireless devices and the disposal of media containing personal information, and an audit of select mortgage brokers in the private-sector.
- Strengthen the Privacy Impact Assessment review process by enhancing the privacy criteria, detailing expectations from federal institutions, offering training to government officials, establishing a repertoire of reviews, and publishing PIA reviews.
- Enforce the legal obligations of organizations through settlements and court-enforced compliance.
- Participate in the creation of a global enforcement network through discussions with international counterparts.
- Continue to work with provincial and territorial counterparts on shared privacy issues. For example, in 2009-2010, the Office helped analyze the privacy impacts of introducing enhanced drivers licences in several provinces, as well as the use of automated licence plate recognition technology in British Columbia. In 2010-2011, the Office will continue to work with the provinces and territories on an as-needed basis, and to interface with provinces with substantially similar privacy legislation to ensure consistent application of the law. There is also the possibility of undertaking a collaborative audit with the Department of Homeland Security in the United States.
Benefits for Canadians from Program Activity 1
Canadians depend on the investigation services delivered by the OPC to safeguard their privacy rights. Audits and PIA reviews also seek to improve management and accountability for privacy within organizations. OPC recommendations aim to improve organizational systems and practices, thus enhancing the privacy rights of individuals for today and future generations.
And, since privacy has no boundaries, joint and collaborative efforts with provincial/territorial and international counterparts mean more effective enforcement of privacy legislation.
2.3 Program Activity 2: Research and Policy Development
Activity Description
The OPC serves as a centre of expertise on emerging privacy issues in Canada and abroad by researching trends and technological developments, monitoring legislative and regulatory initiatives, providing legal, policy and technical analyses on key issues, and developing policy positions that advance the protection of privacy rights. An important part of the work involves supporting the Commissioner and senior officials in providing advice to Parliament on potential privacy implications of proposed legislation, government programs, and private-sector initiatives.
| Expected Results | Performance Indicators (Performance Measurement Strategy) |
Targets |
|---|---|---|
| Intermediate Outcomes | ||
| Parliamentarians and key stakeholders have access to clear, relevant information, and timely and objective advice about the privacy implications of evolving legislation, regulations and policies. | Value added to stakeholders of the OPC information and advice on selected policies and initiatives (Self-assessment of the value-added of the OPC information and advice on key policy files) |
75% effectiveness in adding value to the public and private-sector stakeholders through the OPC information and advice on their policies and initiatives |
| Immediate Outcomes | ||
| The work of Parliamentarians is supported by an effective capacity to identify privacy issues, and to develop privacy-respectful policy positions for the federal public and private sectors. | Value added to Parliament of the OPC views on the privacy implications of relevant laws and regulations (Tracking of support to Parliamentarians, including legislative analysis and appearances at parliamentary committees, through a self-assessment of the value-added of the OPC views) |
75% effectiveness in adding value to Parliamentarians from the OPC views on relevant laws and regulations |
| Knowledge about systemic privacy issues in Canada and abroad is enhanced through information exchange and research, with a view to advancing privacy files of common interest with stakeholders, raise awareness, and improve privacy-management practices. | Stakeholders have had access to, and have considered, the OPC research products and outreach materials in their decision-making (Review of progress reports against the operational plans for the four priority privacy issues to extract evidence that the OPC research products and outreach materials of have had an impact on stakeholders from the OPC research products and outreach materials) |
Initiatives under all four (100%) OPC priority privacy issues have involved relevant stakeholders and there is documented evidence demonstrating that they were impacted by the OPC research products and outreach materials |
| Adjusted Planned Spending | 2010-2011 | 2011-2012 | 2012-2013 |
|---|---|---|---|
| Financial Resources ($000) | 5,058 | 5,135 | 5,135 |
| Human Resources (FTEs) | 18 | 19 | 19 |
Planning Highlights for Program Activity 2
Over the next three years, the OPC will continue to work towards the above Research and Policy Development outcomes while also supporting its third and fourth corporate priorities ("Strategically advance global privacy protection for Canadians" and "Support Canadians, organizations and institutions to make informed privacy choices"). More specifically in 2010-2011, the OPC will pursue the following initiatives, in addition to its usual activities:
- Continue to act on child privacy, in co-operation and co-ordination with other data protection authorities.
- Conduct consultations on consumer privacy issues with industry, government, consumer associations, civil society and other interested parties on some of the most important emerging issues in privacy - behavioural advertising, cloud computing and location-based data.
- Develop and organize a team of investigators prepared to take on complex investigations in the area of social networking and the use of technology.
- Organize public policy workshops with senior government officials and external experts on emerging privacy issues, with the goal of preparing public policy briefs.
- Explore and communicate the privacy implications of emerging technologies, and whether PIPEDA is able to meet those new challenges.
- Develop and enhance relationships with data protection authorities, international organizations and selected regulators.
- Collaborate with federal partners and international counterparts to implement and enforce the Electronic Commerce Protection Act, once it is passed into law.
Benefits for Canadians from Program Activity 2
Knowledge about both emerging and systemic privacy issues is the foundation for OPC advice and guidance, which in turn inform actors about the privacy implications of their actions. For legislators, the implications relate to laws and regulations, and for organizations and Canadians, the implications relate to everyday decisions in the marketplace. An enhanced understanding of national and global privacy issues and a strengthened capacity to address them more effectively are critical for Canada to be recognized as a leader in privacy protection and to positively influence the development of international privacy laws and co-operative agreements.
With the help of effective and well-communicated research activities, policy positions and legal advice from the OPC, decision-makers may better evaluate their actions and measure the privacy risks they assume. Organizations, moreover, are able to comply with their privacy obligations in a more meaningful way.
2.4 Program Activity 3: Public Outreach
Activity Description
The OPC delivers public education and communications activities, including speaking engagements and special events, media relations, and the production and dissemination of promotional and educational material. Through public outreach activities, individuals have access to information about privacy and personal data protection that enable them to protect themselves and exercise their rights. The activities also allow organizations to understand their obligations under federal privacy legislation.
| Expected Results | Performance Indicators (Performance Measurement Strategy) |
Targets |
|---|---|---|
| Intermediate Outcome | ||
| Federal government institutions and private-sector organizations understand their obligations under federal privacy legislations and individuals understand how to guard against threats to their personal information. | Privacy outcome for government initiatives or programs from the PIA consultations/recommendations (Tracking of privacy outcomes from PIA consultations/ recommendations) |
In 70% of the government initiatives or programs for which a high priority PIA was reviewed and a recommendation was issued, a privacy protection was added after the consultations/recommendations from the OPC |
| Extent to which private-sector organizations understand their obligations under federal privacy legislation (Biennial polling of a sector of private industry) |
More than 40% of private-sector organizations report having at least moderate awareness of their obligations under PIPEDA | |
| Immediate Outcomes | ||
| Individuals have relevant information about their privacy rights and are enabled to guard against threats to their personal information. | Reach of target audience with OPC public education activities. (Analysis of reach based on: media monitoring, hits on the OPC website and blogs, audience size of speeches and events, distribution of materials, etc.) |
100 citations of OPC officials on selected communications initiatives per year at least 100,000 hits per month on the OPC website and 20,000 hits per month to the OPC blog at least one news release per month on a subject of particular interest to individuals at least 350 subscribers to the e-newsletter at least 1,000 communication tools distributed per year two public education initiatives annually designed for new individual target groups two public events addressing needs of individual target groups |
| Extent to which individuals know about the existence/role of the OPC, understand their privacy rights, and feel they have enough information about threats to privacy (Biennial public opinion polls and other research activities) |
at least 20% of Canadians have awareness of the OPC at least 20% of Canadians have an "average" level of understanding of their privacy rights at least 35% of Canadians have some awareness of the privacy threats posed by new technologies | |
| Federal government institutions and private-sector organizations receive useful advice and guidance on privacy rights and obligations, contributing to better understanding and enhanced compliance. | Responsiveness of, or feedback from, federal government departments and private-sector organizations to OPC advice and guidance relating to privacy rights and obligations (Tracking and analysis of the positive and negative feedback/ responses received) |
75% of institutions and organizations are responsive to the OPC's advice |
| Reach of organizations with OPC policy positions, promotional activities and promulgation of best practices (Analysis of reach based on: review of Office statistics; analysis of top-10 pages of website and writing of anecdotes on best practices; analysis of targeting, distribution and reach of public education initiatives) |
at least 1,000 communication tools distributed per year at least one news release per month on a subject of particular interest to organizations exhibiting at least four times throughout the year at least 350 subscribers to the e-newsletter two public education initiatives annually designed for new organizational target groups two public events/speaking engagements addressing needs of organizational target groups |
|
| Adjusted Planned Spending | 2010-2011 | 2011-2012 | 2012-2013 |
|---|---|---|---|
| Financial Resources ($000) | 3,846 | 3,921 | 3,921 |
| Human Resources (FTEs) | 25 | 24 | 24 |
Planning Highlights for Program Activity 3
Over the next three years, the OPC will continue to work toward the above Public Outreach outcomes while supporting its fourth corporate priority ("Support Canadians, organizations and institutions to make informed privacy choices"). More specifically in 2010-2011, the OPC will pursue the following initiatives in addition to its usual activities:
- Expand outreach and public education activities with industry associations, business development organizations and other stakeholder groups.
- Increase activities under the regional outreach program to speak to more communities across Canada, including partnerships with privacy commissioners in selected provinces and territories.
- Strengthen the review of Privacy Impact Assessments (PIA) and provide an expectations document to federal entities3 covered under the Privacy Impact Assessment Policy that would offer guidance on what the Office is looking for in PIA reviews. In addition to an assessment of the 10 privacy principles, the intent of the expectations document is to encourage federal entities to demonstrate that:
- an initiative or program with privacy implications is necessary to achieve a specific purpose;
- it is likely to be effective in achieving that purpose;
- the intrusion on privacy is proportional to the benefit to be derived, and
- no other less privacy intrusive alternative would achieve the same purpose.
- Develop and communicate guidance on privacy for federal public servants, including providing an overview of the Privacy Act, reviewing the role of the OPC in reviewing PIAs, highlighting relevant TBS guidelines, and outlining privacy best practices and how they apply in the day-to-day handling of personal information.
- Provide advice and guidance to global organizations to ensure that new technologies and applications comply with PIPEDA.
- Launch and promote the OPC's updated online e-learning tool to help retailers better understand their obligations and comply with PIPEDA, and produce video modules and/or other dynamic tools to help businesses comply with privacy law.
Benefits for Canadians from Program Activity 3
The Privacy Commissioner of Canada has a mandate to raise awareness of rights and obligations under privacy laws. By having a more in-depth understanding of Canadians' views and concerns with respect to their personal information, the OPC is in a better position to educate individuals about their rights, so that they may make informed choices with respect to their personal information protection. As well, by helping organizations understand their responsibilities under federal privacy laws, and by encouraging them to better protect the personal information in their care, Canadians ultimately benefit from enhanced privacy protection.
2.5 Program Activity 4: Internal Services
Activity Description
Internal Services are groups of related activities and resources that support the needs of programs and other corporate obligations of an organization. As a small entity, the OPC's internal services include two sub-activities: governance and management support, and resource management services (which also incorporate asset management services). Given the specific mandate of the OPC, communications services are not included in Internal Services but rather form part of Program Activity 3 - Public Outreach. Similarly, legal services are excluded from Internal Services at OPC, given the legislated requirement to pursue court action under the two federal privacy laws. Legal services form part of Program Activity 1 - Compliance Activities, and Program Activity 2 - Research and Policy Development.
| Expected Result | Performance Indicator (Performance Measurement Strategy) |
Target |
|---|---|---|
| The OPC achieves a standard of organizational excellence, and managers and staff apply sound business management practices. | Ratings against the Management Accountability Framework (MAF) self-assessment (Review of results to the biennial MAF self-assessment exercise and annual progress reports) |
Strong or acceptable rating on 70% of MAF areas of management |
Allocated Financial and Human Resources for Program Activity 4
| Adjusted Planned Spending | 2010-2011 | 2011-2012 | 2012-2013 |
|---|---|---|---|
| Financial Resources ($000) | 5,137 | 5,359 | 5,359 |
| Human Resources (FTEs) | 46 | 46 | 46 |
Planning Highlights for Program Activity 4
The OPC will continue to work toward achieving and maintaining a standard of organizational excellence and have managers and staff apply sound business management practices. Over the next three years, and more particularly in 2010-2011, the OPC will enhance and sustain its organizational capacity (its fifth corporate priority) by pursuing the following Internal Services activities, in addition to its usual activities:
- Continue implementing the OPC Integrated Business and Human Resources Plan 2008-2011, using innovative approaches and solutions to address capacity challenges. These include knowledge acquisition and growth, support for a healthy organization, and service delivery improvements. In 2010-2011, the Plan includes the development of a succession plan for critical positions.
- Foster synergies between OPC branches to increase knowledge and information sharing and to improve decision-making through a variety of new measures in 2010-2011, including:
- Increasing communication between the inquiries unit and other branches of the Office to provide value-added intelligence about the nature and frequency of inquiries and to develop tools for individuals and organizations;
- Offering inter-branch and intra-branch developmental assignments to staff and expanding research teams reviewing emerging issues with knowledgeable and interested staff from all branches;
- Rolling out to all branches an enterprise-wide electronic collaboration tool (SharePoint), which has been successfully piloted in one division of the Office, and providing ongoing training and technical support.
- Enhance managers' and staff's knowledge and use of information management tools and procedures to maximize capabilities and efficiencies, better support research, policy development and other activities, and improve decision-making. Awareness sessions, group training and individual coaching will be provided in the enterprise-wide electronic documents and records system.
- Evaluate space requirements for the OPC, taking into account present and future needs based on organizational growth. There is, for example, the possibility of an expanded regional presence across Canada. A long-term accommodation strategy to address the renovations to the existing location (Place de Ville in Ottawa) is planned for 2013.
