Treasury Board of Canada Secretariat
Symbol of the Government of Canada

ARCHIVED - Office of the Privacy Commissioner of Canada - Report


Warning This page has been archived.

Archived Content

Information identified as archived on the Web is for reference, research or recordkeeping purposes. It has not been altered or updated after the date of archiving. Web pages that are archived on the Web are not subject to the Government of Canada Web Standards. As per the Communications Policy of the Government of Canada, you can request alternate formats on the "Contact Us" page.

Section II: Analysis by Program Activity

OPC Performance in 2009-2010


Strategic Outcome: The privacy rights of individuals are protected.
Expected Result Performance Indicator
Ultimate Outcome for Canadians
The OPC plays a lead role in influencing federal government institutions and private-sector organizations to respect the privacy rights of individuals and protect their personal information. Extent and direction of change in the privacy practices of federal government institutions and private-sector organizations.

In its 2009-2010 Report on Plans and Priorities, the OPC undertook to start reporting on its Strategic Outcome in 2010-2011. Application of the associated performance indicator (gauging the extent and direction of change in the privacy practices of federal government institutions and private-sector organizations) will reveal whether the OPC is achieving the outcome it expects - to play a lead role in influencing federal government institutions and private-sector organizations to respect the privacy rights of individuals and protect their personal information.

Progress toward the Strategic Outcome is already informed by the performance achieved under the four Program Activities of the OPC Program Activity Architecture. For each Program Activity, sub-sections 2.1 to 2.4:

  • describe what is involved in the Program Activity (defined as per the implementation of the TBS Management, Resources and Results Structure Policy);
  • report on planned versus actual resource use in 2009-2010;
  • present a summary of the OPC actual performance in relation to expected results and performance indicators/targets, and include a performance status against the TBS scale (refer to Section 1.2 for a description of the scale), and
  • provide an overall analysis of the OPC performance in 2009-2010, discuss lessons learned from the past year's performance, and articulate the benefits that Canadians derive from the activities delivered by the OPC.

2.1 Program Activity 1: Compliance Activities

Activity Description

The OPC is responsible for investigating complaints and responding to inquiries received from individuals and organizations that contact the OPC for advice and assistance on a wide range of privacy-related issues. The OPC also assesses, through audits and reviews, how well organizations are complying with requirements set out in the two federal privacy laws, and provides recommendations on privacy impact assessments (PIAs) pursuant to the Treasury Board Secretariat policy. This activity is supported by a legal team that provides specialized legal advice and litigation support, and a research team with senior technical and risk-assessment support.

Program Activity 1: Compliance Activities

2009-2010 Financial resources ($000)

2009-2010 Human resources (FTEs)

Planned Spending Total Authorities Actual Spending Planned Actual Difference
9,410 10,414 9,881 81 68 (13)
Expected Results Performance Indicators/Targets Actual Performance Performance Status
Intermediate Outcomes
Individuals receive effective responses to their inquiries and complaints. Indicator: Timeliness of OPC responses to inquiries and complaints

Target: Refer to footnote5
The Office responded to 7,821 inquiries (oral and written) in 2009-2010, 92 percent within the 30-day service standard. Inquiries that were not responded to within the service standard were often more complex and required legal opinions or additional information to respond to the client.

For complaints, timeliness is measured in two ways: the reduction of the backlog of complaints older than one year from the date of receipt, and the treatment time to process a complaint.

An unprecedented effort was invested in 2009-2010 to eliminate the backlog of older complaint files. By March 31, 2010, the backlog was eliminated - a major milestone for the Office.

The calculation of treatment time to process a complaint is based on the average number of months between the date of receipt of the complaint and the date when findings are made or the issue is resolved in some other way. The closure of numerous old files resulted in average treatment times for 2009-2010 that were still very high:
  • Complaints under PIPEDA: 18 months on average to close 576 complaints in 2009-2010, compared to 20.9 months last year.
  • Complaints under the Privacy Act: 15 months on average to close 1,154 complaints in 2009-2010, compared to 19.5 months the year before..
Mostly met
Federal government institutions and private-sector organizations meet their obligations under federal privacy legislation and implement modern principles of personal information protection. Indicator: Extent to which investigation and audit recommendations are accepted and implemented over time

Target: 90% of investigation recommendations are accepted and implemented
Investigations under the PIPEDA

Under the PIPEDA, the Commissioner made recommendations through the Reports of Findings in 56 cases in 2009-2010. Recommendations were fully accepted and implemented in 35 cases (62.5 percent) and accepted and partially implemented in eight more cases (for a total of 77 percent). With respect to the 13 cases where recommendations were not accepted, in 3 of the cases, the Office filed an application in Federal Court to have the Commissioner's recommendations enforced (two of these are ongoing, while one was settled); in the other cases, the OPC decided not to proceed to Federal Court on the basis of a variety of considerations, including that the OPC did not have the power to proceed to Federal Court or the responding organization had ceased to exist.

Investigations under the Privacy Act

Under the Privacy Act, informal recommendations are normally made throughout the investigation process and responded to prior to the end of the investigation. In 2009-2010, the Commissioner made formal recommendations in the Report of Findings in 11 cases. The respondents accepted the recommendations in nine cases (82 percent) and, to-date, recommendations have been implemented in one of the nine cases. In the other eight cases, sufficient time has not passed to allow for implementation. The OPC will follow up with the organizations to record the implementation of its recommendations.
Somewhat met
Target: 90 percent of audit recommendations are accepted fully by entities; upon re-audit, two years after the initial report, action to implement has begun on 90 percent of recommendations Of the five audits6 that were completed during 2009-2010, 30 recommendations were made and 29 (97 percent) were accepted by the audit entities at the time of reporting.

Follow-up is made two years after audit reports are issued to determine the rate of implementation of the recommendations. Of the 21 audit recommendations verified during 2009-2010, action had begun on all (100 percent).
Exceeded
Federal government institutions and private-sector organizations meet their obligations under federal privacy legislation and implement modern principles of personal information protection. Indicator: OPC recommendations that are not resolved through the investigation process are advanced before the courts, where possible

Target: OPC recommendations advanced before the courts are either settled to the satisfaction of the Commissioner or there is a court decision elaborating the law
From April 1, 2009 to March 31, 2010, the OPC was involved in 14 litigation cases related to PIPEDA and five cases related to the Privacy Act in order to promote compliance with federal privacy legislation. Most of these cases are still before the courts.

Two cases were settled to the satisfaction of the Commissioner and the parties.

In another case, the court rendered a judgment that clarified legal obligations, thus facilitating compliance with privacy legislation.
Met all
Immediate Outcomes
The process to respond to inquiries and investigate complaints is effective and efficient. Indicator: Timeliness of OPC responses to inquiries and complaints Refer to performance information for the same indicator earlier in this table. Mostly met
The process to conduct audits and reviews is effective and efficient, including effective review of privacy impact assessments (PIAs) for new and existing government initiatives Indicator: Extent to which audit recommendations are accepted and implemented over time Refer to performance information for the same indicator earlier in this table. Exceeded
The process to conduct audits and reviews is effective and efficient, including effective review of privacy impact assessments (PIAs) for new and existing government initiatives Indicator: Proportion of audits and PIA reviews completed within planned times

Target: 50% of audits are completed within planned times and 50% of PIA reviews are completed within 90 days of receipt
Five audits and one follow-up to an audit were completed in 2009-2010, all within their planned timelines. Note that some changes were made to the risk-based audit plan during the year for several reasons: a follow-up to the audit of the PIA function was cancelled due to the impending change in the TBS PIA directive; a follow-up to the Royal Canadian Mounted Police Exempt Data Bank Operations Audit was deferred until 2010-2011 and, upon further consideration, a planned audit of secure channel operations was cancelled and replaced by an audit that examines the disposal practices of selected federal entities.

Potential audits of Integrated Border Enforcement Teams, Public Safety Canada, the Canadian Air Transport Security Authority and Trusted Traveller Programs that were originally planned for 2009-2010 are being assessed and considered as part of developing the next risk-based audit plan. The audit plan will be completed in 2010-2011.

During 2009-2010, the OPC received a total of 102 PIAs, which represents a significant increase from the 64 received in the previous reporting period. This year, the OPC began to implement a triage process for PIAs to focus limited resources on reviewing higher-risk initiatives, which led to improved timeliness in the PIA reviews. The Office sent out 33 letters of recommendation; 23 (or 70 percent) of those reviews were completed within the 90-day standard that the OPC strives for to provide institutions with timely and relevant advice.
Met all
  Indicator: Responsiveness of (or feedback from) federal government departments and private-sector organizations7 to OPC advice relating to privacy rights and obligations and PIAs

Target: 75 percent of institutions and organizations are responsive to the OPC advice
In 2009-2010, the Office sent out 33 letters of recommendation at the conclusion of PIA reviews and, in 79 percent of these cases, federal institutions responded favorably in whole or in part to the OPC advice, proposed mitigating measures and/or recommendations.

Federal institutions are not obliged to respond to the OPC's PIA reviews. Moreover, when entities to respond, agreement is not always explicitly outlined. The Office, however, has observed an increasing level of engagement and co-operation during the PIA process.
Exceeded

Performance Analysis

The Office eliminated the backlog of older complaint files that had persisted for several years. The average treatment time to complete investigations remains high as a result of the many backlogged files that were closed during 2009-2010. The Office is confident that treatment times for the next reporting period will improve considerably.

The majority of the Commissioner's investigation recommendations were accepted and implemented by federal institutions and private-sector organizations (allowing sufficient time after the completion of investigations), although the high performance target of 90 percent was only somewhat met. The high level of litigation activity in the past fiscal year demonstrates the OPC's ongoing commitment to pursue court enforcement of recommendations that are not resolved through the investigation process.

The investigation process was re-engineered during the year and a new case management system was implemented to support the realigned processes. The audit and PIA work, for which new methods were applied, progressed satisfactorily.

Lessons learned

Considering the significant effort that led to the elimination of the complaint investigation backlog and the introduction of a re-engineered investigative framework during the same time period, the OPC has planned a review for early in the next fiscal year to identify and integrate lessons learned to further improve processes and practices. As well, service standards for inquiry and investigation activities will be set in 2010-2011.

The number of PIA reviews completed during the year (33, compared to 31 in 2008-2009) has not increased substantially. However, the PIA function continues to be improved through the implementation of a new triage process; completion of an internal transformation in the way PIA reviews are conducted; the addition of new staff, and increased outreach to institutional officials.

Benefits for Canadians from this Program Activity

In responding to inquiries, the OPC informs Canadians of their privacy rights. In conducting complaint investigations, audits and PIA reviews, the Office establishes whether government institutions and private-sector organizations plan to and/or collect, use, disclose, retain and dispose of Canadians' personal information in accordance with the privacy protections set out in the two federal privacy laws. Where non-compliance is identified, the OPC takes action to influence change. Investigating one individual's privacy complaint can have a huge impact when it leads to improvements that affect many Canadians.

2.2 Program Activity 2: Research and Policy Development

Activity Description

The OPC serves as a centre of expertise on emerging privacy issues in Canada and abroad by researching trends and technological developments; monitoring legislative and regulatory initiatives; providing legal, policy and technical analyses on key issues, and developing policy positions that advance the protection of privacy rights. An important part of the work done involves supporting the Commissioner and senior officials in providing advice to Parliament on potential privacy implications of proposed legislation, government programs and private-sector initiatives.

Program Activity 2: Research and Policy Development
2009-2010 Financial resources ($000) 2009-2010 Human resources (FTEs)
Planned Spending Total Authorities Actual Spending Planned Actual Difference
4,288 4,558 4,067 17 22 5
Expected Results Performance Indicators/Targets Actual Performance Performance Status
Intermediate Outcome
Parliamentarians and key stakeholders have access to clear, relevant information and timely and objective advice about the privacy implications of evolving legislation, regulations and policies. Indicator: Parliament and sponsoring departments have been provided with the OPC views on the privacy implications of relevant laws, regulations and policies in progress

Target: Where appropriate, OPC views on the privacy implications of legislation, regulations and policies are made available to stakeholders in a timely fashion
In 2009-2010, the OPC made 14 appearances before parliamentary committees to provide views and advice on the privacy implications of new legislation or ongoing programs. Topics and issues included reform of the Privacy Act, the National Sex Offender Registry, the National DNA Databank, and the regulatory environment around the Canadian wireless sector. (More detail on appearances can be found at http://www.priv.gc.ca/parl/
index_e.cfm
). At all appearances, committees expressed appreciation for the OPC's perspective.

The Office reviewed the privacy implications of 10 new bills during the fiscal year. They related to a range of issues, including new measures to combat identity theft and spam e-mail, a proposal to overhaul Canada's search and surveillance laws, and tracking pathogens and adverse drug reactions in the Canadian population.
Met all
Immediate Outcomes
The work of Parliamentarians is supported by an effective capacity to identify and research privacy issues, and to develop policy positions for the federal public and private sectors, which are respectful of privacy. Indicator: Parliament and sponsoring departments have been provided with the OPC views on the privacy implications of relevant laws, regulations and policies in progress

Target: Where appropriate, OPC views on the privacy implications of legislation, regulations and policies are made available to stakeholders in a timely fashion
In addition to appearances before parliamentary committees, the OPC had 45 other interactions - meetings, teleconferences, formal briefings or correspondence - with individual parliamentarians on matters of privacy and data protection. A range of privacy concerns were reflected in these discussions, from new ‘know your customer' measures being required of the financial services sector to the use of body-scanning technologies at airport checkpoints. OPC interactions with parliamentarians were generally well-received and the Office's input on privacy issues appreciated.

During the reporting period, the OPC issued policy guidance through 18 submissions, factsheets and papers. These dealt with the privacy rights of Canadian travellers; how the Canadian Radio-television Telecommunications Commission (CRTC) determines expectation of privacy around customer information; industry use of deep packet inspection (DPI) technologies; changes to Canada's legal framework around surveillance, and the risks of social media for businesses.

The OPC conducted internal reviews of 61 government initiatives and 17 private-sector policies during 2009-2010, providing policy positions that advance the protection of privacy rights.
Met all
Knowledge about systemic privacy issues in Canada is enhanced through research, with a view to raising awareness and improving privacy management practices. Indicator: Stakeholders have had access to, and have considered, OPC research products and outreach materials them in their decision-making

Target: Initiatives related to all four OPC priority privacy issues have involved the relevant stakeholders and there is documented evidence that they were impacted by the OPC research products and outreach materials
The Office has increased channels used to distribute the results of research by organizing workshops, sponsoring seminars and encouraging the presentation of research efforts at industry and learning events. Examples include three joint colloquia with Genome Canada on genetic information; research to analyze behavioural targeting by organizations that culminated in a workshop; public opinion information on geospatial privacy from an NRCan GeoConnections research, and two workshops on privacy and geolocation technologies organized by the Office and involving government, industry and advocacy stakeholders.

Research examined locational technology, biometrics, legislative options for ensuring child privacy, as well as the protection of privacy rights during the 2010 Vancouver Olympic and Paralympic Games. Online tools such as the OPC blog (http://blog.privcom.gc.ca/) play an important role in making research broadly available.

In 2009-2010, the Office updated the privacy quiz (http://priv.gc.ca/
quiz/index_e.cfm
) destined for small businesses, and also made Qs and As on FINTRAC available (http://priv.gc.ca/resource/
t_faqs_index_e.cfm
).

The OPC continued to refresh material available on the "Legal Corner" pages of its website to inform Canadians about legal developments and what they mean for their day-to-day lives. For example, a recent addition discusses privacy issues related to cloud computing (http://www.priv.gc.ca/
information/pub/cc_201003_e.
cfm#toc2a
).

A statutory evaluation of the OPC Contributions Program was completed, including consultations with stakeholders, and the mandate for the Program was renewed. In 2009-2010, 11 organizations across Canada received funding for research in one or more of the priority privacy issue areas, for a total of $454,697 (http://www.priv.gc.ca/media
/nr-c/2009/nr-c_090529_cp_e.cfm
).
Met all

Performance Analysis

The Office has seized upon opportunities to promote public discussion of contemporary privacy issues. As a result of the investigation into Facebook, a considerable amount of research was conducted into privacy attitudes around social networking and child privacy online. Other research projects encouraged the study of privacy in relation to the 2010 Vancouver Olympic and Paralympic Games, and surveillance in general.

Lessons learned

In staffing positions, the Office has favoured candidates with technical skills, familiarity with new media, and experience in collaborative work environments. In 2009-2010, the OPC hired a parliamentary affairs officer as well as a student through the Federal Student Work Experience Program (FSWEP). As well, the OPC continues to seek opportunities to partner with other public, private, and not-for-profit organizations with similar goals of promoting privacy protection.

Benefits for Canadians from this Program Activity

By examining federal programs and policies that touch on privacy, business processes that affect information security, and innovative technologies that pose challenges to personal privacy, the OPC is helping raise awareness of privacy issues among Canadians. Through its research programs, the Office also advances knowledge about privacy issues, in Canada and abroad, among institutions, businesses and the public.

2.3 Program Activity 3: Public Outreach

Activity Description

The OPC delivers a number of public education and communications activities including speaking engagements and special events, media relations, and the production and dissemination of promotional and educational material. Through public outreach activities, individuals have access to information about privacy and personal data protection that enables them to protect themselves and exercise their rights. The activities also allow organizations to understand their obligations under federal privacy legislation.

Program Activity 3: Public Outreach
2009-2010 Financial resources ($000) 2009-2010 Human resources (FTEs)
Planned Spending Total Authorities Actual Spending Planned Actual Difference
3,585 3,592 3,213 23 22 (1)
Expected Results Performance Indicators/Targets Actual Performance Performance Status
Intermediate Outcomes
Individuals have relevant information about privacy rights and are enabled to guard against threats to their personal information. Indicator: Reach of target audience with OPC public education and communication activities

Target: 100 citations of OPC officials on salient privacy issues per year; at least 100,000 hits on the OPC website and 10 comments on OPC blogs per month; at least three speeches/ events per month, reaching a minimum of 1,000 persons in total; at least 1,000 publications sent per year; and an average of one news release per month
OPC officials were cited in the media thousands of times on hot privacy issues - in Canada and around the world. Topics included social networking and the OPC's investigation of Facebook; privacy and street-level imaging applications such as Google Street View; Bills C-46 and C-47, and millimetre-wave scanners at airports. More than 30 press releases were disseminated on a variety of issues, such as the OPC's annual reports and public-sector audits, national poll results, the OPC's consultations, the Facebook probes and Google Buzz.

The OPC produced about 30 distinct tools and publications, including annual reports and audits, as well as guidance for businesses and individuals on, for example, street-level imaging, social networking in the workplace, covert video surveillance, truncating credit card numbers on receipts, and security measures in air transportation. The OPC also produced other tools to raise awareness, including editorial cartoons and illustrations on a range of privacy issues and an instructional video for businesses.

In 2009-2010 the OPC had more than 2 million hits to its website, an increase from 1.7 million the year before.

Approximately 16,000 publications were distributed in 2009-2010, up from 13,000 the year before. One distribution campaign was targeted specifically at the ATIP community.

The number of speeches delivered by OPC officials rose by nearly 50 percent, to 199 in 2009-2010 from 135 the previous year.

The OPC's youth privacy website, created in 2008-2009, was refreshed with additional material, including a revitalized blog and tip sheets, animated videos and lesson plans geared variously to youth, parents and teachers. The second year of the Youth Privacy Video contest saw a doubling of participation by students across Canada.

The OPC has begun to build relationships with national associations representing teachers and librarians, and is developing more public education materials for young Canadians, their parents and teachers.
Exceeded
Federal government institutions and private-sector organizations understand their obligations under federal privacy legislation. Indicator: Responsiveness of (or feedback from) federal government departments and private sector organizations to OPC advice relating to privacy rights and obligations and PIAs

Target: 75 percent of institutions and organizations are responsive to the OPC advice
The OPC received 102 new PIA submissions in fiscal 2009-2010. Not all PIA reviews result in letters of recommendations. During the reporting period, the Office sent out 33 letters of recommendation and, in 79 percent of these cases, federal institutions responded favorably in whole or in part to the OPC advice, mitigating measures and/or recommendations.

Federal institutions are under no obligation to respond to the OPC PIA reviews or to implement PIA recommendations. The Office, however, observes a higher level of engagement and co-operation from departments during the PIA process.
Exceeded
Indicator: OPC had a positive influence on the development of relevant jurisprudence and policy resulting in clearer legal obligations of government institutions and private-sector organizations

Target: Courts and Commissioners of Inquiry have heard and considered OPC arguments
The OPC was involved in three matters before the courts in the past year, which resulted in positive developments for privacy. In the first, the OPC supported the U.S. Federal Trade Commission (FTC) by participating as amicus curiae in litigation before the American courts. The FTC was successful in this matter, and the decision of the U.S. Court of Appeals was consistent with the submission of the OPC. The OPC was also involved in two matters before the Federal Court of Canada that resulted in successful settlements, thereby enhancing compliance with privacy legislation. Met all
Immediate Outcomes
Individuals receive and have easy access to relevant information about privacy and personal data protection, enabling them to better protect themselves and exercise their rights. Indicator: Reach of target audience with OPC public education and communication activities Refer to performance information for the same indicator earlier in this table. Exceeded
Indicator: Extent to which individuals know about the existence/role of the OPC, understand their privacy rights, and feel they have enough information about threats to privacy

Target: At least 15 to 20 percent of Canadians have some awareness of the OPC; at least 15 to 20 percent of Canadians have at least an "average" level of understanding of their privacy rights; and at least 35 to 40 percent of Canadians have some level of awareness of the privacy threats posed by new technologies
In March 2009, the OPC conducted a public opinion poll (published in early 2009-2010). Among the findings were:

One third (33 percent) of Canadians were aware of federal institutions that help protect personal information. Of those, nearly one in five (18 percent) were aware of the OPC.

Twenty-eight percent of Canadians rated their knowledge of privacy rights as good or very good, up significantly from 13 percent in 2001. Conversely, the proportion who rated their knowledge as poor or very poor dropped substantially from 60 percent to 35 percent since the question was asked in a 2001 poll.

Canadians appear to be less confident that they understand the impact of new technologies on their privacy. Only 45 percent said they felt that they had enough information to know how their privacy could be affected by new technologies, a decline of six percentage points in just two years. To view the complete report: http://www.priv.gc.ca/information
/survey/2009/
ekos_2009_01_e.cfm
Met all
Federal government institutions and private-sector organizations receive useful guidance on privacy rights and obligations, contributing to better understanding and enhanced compliance.

Indicator: Reach of organizations8 with OPC policy positions, promotional activities and promulgation of best practices

Target: 100 citations of OPC officials on salient privacy issues per year; at least 100,000 hits on the OPC website and 10 comments on OPC blogs per month; at least three speeches/ events per month, reaching a minimum of 1,000 persons in total; at least 1,000 publications sent per year; and an average of one news release per month

In 2009-2010, the OPC launched nine new guidance documents -- one related to the Office's role and mandate, five related to PIPEDA matters (for example, social networking in the workplace, street-level imaging and covert video surveillance) and three related to public-sector privacy issues (privacy and the Olympics, aviation and border security measures, and individuals' rights in the public sector).

The OPC also produced new tools to assist businesses in safeguarding customer personal information, such as a video on PIPEDA responsibilities for small businesses. The Office also continued to make available the popular PIPEDA guide for businesses, as well as the guide for individuals (http://priv.gc.ca/resource/
io_pr_e.cfm
). The OPC continued to produce and disseminate its e-newsletter, which now has more than 800 subscribers.

The OPC published an innovative series of essays on deep packet inspection (http://dpi.priv.gc.ca). It also commissioned a comprehensive review of research literature on child privacy, and supported a workshop in Fredericton on the subject. In addition, the Office organized a workshop on surveillance, privacy and the 2010 Vancouver Olympic Games.

Poll results from research conducted in 2009-2010 and published in early 2010-2011 demonstrated favourable results with respect to increased levels of awareness and understanding among businesses about their responsibilities under PIPEDA. (http://www.priv.gc.ca/
information/survey/2010/
ekos_2010_01_e.cfm
)

The OPC consulted with and/or provided guidance to federal departments and agencies with respect to issues such as PIPEDA review, enhanced drivers licences, lawful access, personal health information, spam and spyware, and the no-fly list. The OPC also engaged with business groups on issues such breach notification, privacy policies, outsourcing and data security.

Discussions continued with the Canada School for Public Service on the creation of targeted privacy training for federal public servants.

The OPC blog (http://blog.privcom.gc.ca/) continues to be referenced by stakeholders, and the OPC's new account on messaging application Twitter (http://www.twitter.com/
privacyprivee
) has proven valuable in engaging Canadians on issues of immediate interest.
Met all

Performance Analysis

The OPC's public education activities, especially presentations to primary and secondary schools as well as small business organizations, have been well received across the country. The Office has found online and social media tools increasingly important, enabling the Office to establish a dialogue on contemporary issues with individual Canadians and interested stakeholders.

As detailed in the table above, the OPC enhanced its audience reach in 2009-2010 with considerably more speeches delivered to conferences and other events across Canada, and more guidance documents and others publications developed and distributed. As well, the Office issued 61 news releases and other communications tools and conducted more than 300 media interviews.

In 2009-2010, the OPC also committed to providing information and tools to disadvantaged communities9 . Toward that end, the Office funded through its Contributions Program an awareness campaign on the Canadian privacy protection framework for official language minorities; awareness seminars on identity theft and privacy protection for seniors; and a public education campaign for Canadians with hearing impairments.

Lessons learned

The OPC's use of traditional and non-traditional communications tools and channels has raised awareness of privacy issues among a variety of stakeholder groups, including the media. The Facebook probe had a dramatic impact on public awareness of privacy issues in 2009-2010.

The Office's outreach activities in Atlantic Canada have strengthened relationships with provincial colleagues and raised awareness of privacy rights and obligations in the region. These activities were complemented by communications activities to further strengthen federal-provincial-territorial initiatives, such as joint statements, media activities, and the development of guidance. The OPC is extending its regional activities by opening an office in Toronto in the next fiscal year.

Benefits for Canadians from this Program Activity

By raising organizations' awareness of their obligations under federal privacy laws and furnishing them with tools and information to better protect the personal information in their care, the OPC is helping to strengthen the privacy protections enjoyed by Canadians. The Office also directs communications and outreach activities specifically at individuals, thus heightening their awareness of their rights and abilities to exercise them. With a better understanding of the issues, Canadians are also better equipped to protect their personal information and reduce their privacy risks.

2.4 Program Activity 4: Internal Services

Activity Description

Internal Services are groups of related activities and resources that support an organization's programs and other corporate obligations. As a small entity, the OPC's Internal Services include two sub-activities: governance and management support, and resource management services (which also incorporate asset management services). Given the specific mandate of the OPC, communications services are not included in Internal Services but rather form part of Program Activity 3 - Public Outreach. Similarly, legal services are excluded from Internal Services at the OPC, given the legislated requirement to pursue court action under the two federal privacy laws. Legal services form part of Program Activity 1 - Compliance Activities, and Program Activity 2 - Research and Policy Development.

Program Activity 4: Internal Services
2009-2010 Financial resources ($000) 2009-2010 Human resources (FTEs)
Planned Spending Total Authorities Actual Spending Planned Actual Difference
5,040 5,246 5,479 46 46 0
Expected Results Performance Indicators/Targets Actual Performance Performance Status
The OPC achieves a standard of organizational excellence, and managers and staff apply sound business management practices. Indicator: Ratings against Management Accountability Framework - MAF

Target: Strong or acceptable rating on 70 percent of MAF areas of management
As an Officer of Parliament, the OPC is not subject to a MAF assessment by Treasury Board Secretariat. Nonetheless, the Office conducts a comprehensive self-assessment exercise against the MAF biennially, and a status update on improvements in the intervening years. The OPC uses this exercise as a report card on its ‘state of management'. Since the self-assessments started, there has been continuous progress in the OPC state of management: in 2006-2007, 40 percent of MAF management areas were either strong or acceptable; in 2008-2009, it was 60 percent; and the October 2009 status update indicates an 80 percent rating.

Areas where OPC's management practices10 met or exceeded MAF expectations were: values-based leadership and organizational culture; corporate performance framework; corporate management structure; quality of analysis in Treasury Board submissions; quality and use of evaluation; quality of performance reporting; corporate risk management; fair workplace; sustainable workforce; information management; IT management; project management; procurement; financial management and control; internal audit, and alignment of accountability instruments.

Areas where OPC still had opportunities for improvement when the last self-assessment was completed were: managing organizational change; asset management; management of security and business continuity; and citizen-focused service. Since then, the improvement required in the management of security and business continuity has been addressed, and the Office has planned activities to address the other areas in 2010-2011.

The fall 2008 Public Service Employee Survey (results were analyzed and published in 2009-2010), in which 65 percent of OPC staff participated, indicated that employees were committed to providing a high level of service to Canadians.

When employees leave the OPC, they are encouraged to complete an exit questionnaire. Results from questionnaires completed in 2009-2010 show that the primary reason for departures was to gain better future career/advancement opportunities. Overall, a high level of satisfaction was expressed by departing employees with respect to values and ethics of management; working conditions (office environment); autonomy; policies and procedures, and hours of work.

The OPC introduced an Awards and Recognition Program in the past year to formally recognize the contributions of staff.
Exceeded

Performance Analysis

The MAF self-assessment exercises demonstrate that the OPC continues to improve its management framework with more rigorous processes, practices, controls and tools. More work is required, however, particularly to review and set service standards for investigations, now that the major re-engineering work is complete.

In addition to the 2009-2010 achievements noted in the above table, the OPC:

  • continued implementing its Integrated Business and Human Resources Plan, which effectively addressed issues such as employee orientation and specialized training, and stabilized the workforce;
  • implemented commitments from the second year of the 2008 Business Case II, particularly addressing issues of capacity in compliance activities: starting in February 2010, 20 new inquiry and investigation staff joined the OPC and received training, and the OPC now has investigators specialized in IT;
  • completed the implementation of the case management system in September 2009, a major milestone in improving the management of information and data;
  • put in place an internal audit function, as per the TBS Policy on Internal Audit, with an Audit Committee active since January 2009 and composed of external members (http://www.priv.gc.ca/aboutUs/iac_e.cfm#contenttop). Internal audits of information management practices and the human resources functions were completed in 2009-2010, with final reports to be posted on the OPC website in 2010;
  • processed all requests for information received during the reporting period within the legislated timeframe: 52 requests under the Access to Information Act and 61 requests under the Privacy Act.

Lessons learned

With the continued implementation of the 2008-2011 Integrated Business and Human Resources Plan, the OPC took an assertive approach toward recruitment and retention, and the results have been positive. Leaves (without pay or maternity) were filled temporarily by contractors where appropriate, and students were also employed to relieve workload while staffing procedures were underway. As for many organizations the challenge for the OPC is to maintain the momentum in a competitive and changing labour market.

The OPC has experienced significant changes in recent years, including a significant influx of new investigators, a new system to manage its caseload data, outsourcing as a new method of working. The Office will continue to evolve with more change, such as the opening of a new office in Toronto in 2010. As such, the OPC is formalizing a strategy for change management.

The Office will also review its new case management system in 2010-2011, to ensure the system meets OPC information.

The internal audit function, in existence since January 2009, is driving valuable improvements to OPC management practices. However, the number of audit projects that can be performed in a fiscal year may need to be reduced, given the investment of time and resources that the first few audits required.