ARCHIVED - Office of the Privacy Commissioner of Canada - Report

This page has been archived.

2009-10
Departmental Performance Report

Office of the Privacy Commissioner of Canada

The original version was signed by
The Honourable Robert D. Nicholson, P.C., Q.C., M.P.
Minister of Justice and Attorney General of Canada

---

Table of Contents

Message from the Privacy Commissioner of Canada

Section I: Overview

• 1.1 Summary Information
• 1.2 Performance Summary

Section II: Analysis by Program Activity

• 2.1 Program Activity 1: Compliance Activities
• 2.2 Program Activity 2: Research and Policy Development
• 2.3 Program Activity 3: Public Outreach
• 2.4 Program Activity 4: Internal Services

Section III: Supplementary Information

• 3.1 Financial Highlights
• 3.2 Supplementary Information Tables

Message from the Privacy Commissioner of Canada

I am pleased to table before Parliament the Departmental Performance Report of the Office of the Privacy Commissioner of Canada (OPC) for the fiscal year ending March 31, 2010.

It was a year in which the eyes of the world turned to Canada and our determination to safeguard the privacy rights of individuals threatened by the most ordinary of activities - networking with their friends online. Our in-depth investigation of Facebook's privacy policies and practices was groundbreaking in that it preceded today's wholesale re-examination of online privacy across cyberspace and around the globe.

And yet, for all its public profile, the Facebook investigation was just one highlight among many others achieved in 2009-2010 - all of them serving the privacy interests of Canadians in one way or another. We are also very pleased to report to Parliament that we have eliminated our longstanding backlog of unresolved complaints, freeing us to focus on more complex and systemic issues. At the same time, we instituted new technologies and processes to ensure we continue to deal with complaints in a timely manner.

To name just a few highlights from last year:

• Our privacy audits and reviews of privacy impact assessments shone a spotlight on contemporary challenges to privacy, including national security, aviation safety and technology.
• We continued to work with parliamentarians and through the courts to ensure that legislative and other policy initiatives are sensitive to privacy. While significant amendments to the Privacy Act appear to be out of reach for now, we nevertheless pressed ahead and proposed a series of administrative alternatives.
• Through workshops, briefings, research and public outreach, we continued our efforts to explore the impact on privacy of four priority sectors: national security, information technology, genetic information and identity integrity.
• We continued to reach out to business and other target groups with clear and specific guidance, and promoted awareness of privacy challenges among youth and the public at large.
• Globally, we participated in numerous initiatives aimed at strengthening privacy protections and the security of international data flows.
• Internally, we focused on building capacity by recruiting and retaining skilled, dynamic, dedicated - and, in many cases, young - employees.

The report that follows provides more details on these and many other activities that helped make 2009-2010 stand out as a banner year for the OPC. At the same time, it provides context for the new year underway, and the opportunities and challenges ahead. In the wake of the Facebook investigation, for instance, we have already confronted other technology giants, and have expressed renewed concerns over Facebook's practices.

Sadly, we will be saying goodbye to Elizabeth Denham, the Assistant Commissioner responsible for the Personal Information Protection and Electronic Documents Act, as she takes over as the Information and Privacy Commissioner for British Columbia. On the plus side, we look forward to opening a new office in Toronto, from which we can better interact with business and other stakeholders.

Against this backdrop, I am pleased to share this report on last year's achievements in protecting and promoting the privacy rights of Canadians.

Section I: Overview

1.1 Summary Information

Raison d'être

The mandate of the Office of the Privacy Commissioner of Canada is to oversee compliance with both the Privacy Act, which covers the personal information-handling practices of federal government departments and agencies, and the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's private-sector privacy law. The mission of the Office is to protect and promote the privacy rights of individuals¹.

Responsibilities

The Privacy Commissioner of Canada, Jennifer Stoddart, is an Officer of Parliament who reports directly to the House of Commons and the Senate. The Commissioner is an advocate for the privacy rights of Canadians and her powers include:

• investigating complaints, conducting audits and pursuing court action under two federal laws;
• publicly reporting on the personal information-handling practices of public- and private-sector organizations;
• advising on and reviewing privacy impact assessments (PIAs) of new and existing government initiatives;
• supporting, undertaking and publishing research into privacy issues, and
• promoting public awareness and understanding of privacy issues.

The Commissioner works independently from any other part of the government to investigate complaints from individuals with respect to the federal public sector and the private sector. The Office focuses on resolving complaints through negotiation and persuasion, using mediation and conciliation where appropriate. However, if voluntary co-operation is not forthcoming, the Commissioner has the power to summon witnesses, administer oaths and compel the production of evidence. In cases that remain unresolved, particularly under PIPEDA, the Commissioner may take the matter to Federal Court and seek an order to rectify the situation.

Strategic Outcome and Program Activity Architecture

To pursue its mandate effectively, the OPC works toward a single Strategic Outcome: the protection of the privacy rights of individuals. Three program activities and one management activity support this Strategic Outcome, as outlined in the diagram below.

Strategic Outcome	The privacy rights of individuals are protected.
Program Activity	1.  Compliance Activities	2.  Research and Policy Development	3.  Public Outreach
	4.  Internal Services

Alignment of Program Activity Architecture to Government of Canada Outcomes

The Privacy Commissioner is an Officer of Parliament who reports directly to Parliament. The Strategic Outcome of, and the expected results from, her Office are detailed in Section II of this Departmental Performance Report.

1.2 Performance Summary

The following table presents the total financial and human resources that the OPC has managed in 2009-2010.

Financial and Human Resources

2009-2010 Financial Resources ($000)

Planned Spending	Total Authorities	Actual Spending
22,323	23,810	22,640

2009-2010 Human Resources (FTEs*)

Planned			Actual	Difference
FTEs (including FedAA)	Adjustment: FedAA	Adjusted FTEs
178	(11)	167	158	(9)
* Full-time Equivalents

Commencing in the 2009-10 Estimates cycle, the resources for the Internal Services program activity are displayed separately from other program activities; they are no longer distributed among the remaining program activities, as was the case in previous Main Estimates. This has affected the comparability of spending and FTE information by program activity between fiscal years.

The originally planned FTEs presented in the 2009-2010 Report on Plans and Priorities included the human resources related to the Federal Accountability Act (FedAA) of 11 FTEs, as identified in the FedAA Action Plan funding in the 2006 Federal Budget. The OPC was allocated 167 FTEs to carry out its 2009-2010 activities. The Office used 158 FTEs in 2009-2010, which represents 94.6 percent of the 167 adjusted planned FTEs. The variance of nine FTEs is mainly due to the turnover of staff during this fiscal year and to the Office having used more professional services to meet and achieve its commitments.

Contribution of Priorities to the Strategic Outcome

In 2009-2010, the OPC had five corporate priorities, which are listed in the table below. Work to advance each priority contributed to progress toward the Office's Strategic Outcome. The following table presents, for each priority, a performance summary against the specific commitments made in the 2009-2010 Report on Plans and Priorities and a self-assessment of performance status based on the Treasury Board Secretariat's scale² . More performance information is also provided in Section II - Analysis by Program Activity.

Strategic Outcome: The privacy rights of individuals are protected.

OPC Priorities for 2009-2010	Type3	Performance Summary	Performance Status
1. Continue to improve service delivery through focus and innovation	Ongoing	The backlog of complaint files older than one year from receipt was eliminated as planned. A robust exercise to streamline the OPC investigative process was implemented successfully. An early resolution unit was created and of the complaint files that were received and closed (477 files) in 2009-2010, 25 percent were early resolved, thereby avoiding the more resource-intensive investigation process and contributing to a decline in new complaints being registered under both Acts. A new position of Complaint Registrar was created to assign priorities to complaints received and better allocate OPC investigative resources. Regular meetings were instigated with federal departments that hold large amounts of personal information under the Privacy Act, in order to facilitate information exchange and resolution. A new standardized privacy audit methodology was drafted in 2009-2010 and will be formalized in 2010-2011. A new approach to the review of Privacy Impact Assessments (PIAs) was adopted so that reviews would be grounded in human rights law. Government institutions are now challenged in their PIAs to justify infringement of privacy in relation to the necessity, effectiveness and proportionality of the proposed measure, as well as the availability of any more privacy-sensitive alternatives (a four-part test derived from the Supreme Court of Canada ruling in the case of R. v. Oakes). A triage method was instituted to address the increased number of PIA submissions received. The OPC conducts at least quarterly meetings with provinces with substantially similar legislation to identify emerging privacy issues. This year, the Office collaborated with the province of British Columbia to publish a guidance document on privacy and the Olympics.	Met all
2. Provide leadership to advance four priority privacy issues (information technology, national security, identity integrity and protection, and genetic information)	Previous	Implementation began in 2009-2010 on the three-year strategic plans adopted for the four priority privacy issues that were approved last year. Progress monitoring and reporting against the plans show the following key accomplishments: Information technology: The OPC organized two well-attended workshops to examine aspects of geospatial information and privacy (http://www.priv.gc.ca/newsletter-bulletin/2009-4/3_e.cfm). Industry briefings on new and emerging technologies and services were organized on topics such as online authentication, cloud computing, biometrics, road-use charging, and e-passports, significantly increasing OPC knowledge of these issues. National security: The OPC audited national security programs including the Passenger Protect Program (http://www.priv.gc.ca/information/pub/ar-vr/ar-vr_ppp_200910_e.cfm) and FINTRAC (http://www.priv.gc.ca/information/pub/ar-vr/ar-vr_fintrac_200910_e.cfm) and followed up on implementation of recommendations made as part of the 2006 audit of the Canada Border Services Agency (http://www.priv.gc.ca/information/pub/ar-vr/cbsa_060620_e.pdf). The Office prioritized Privacy Impact Assessments related to national security. Several learning events relating to national security took place in 2009-2010 and have deepened OPC knowledge in this area. Identity integrity and protection: The Office published the results of its exhaustive 14-month investigation into Facebook's privacy policies and practices, which highlighted concerns about the company's transparency with respect to its use of personal information (http://www.priv.gc.ca/cf-dc/2009/2009_008_0716_e.cfm), prepared associated research and public education material, and advanced the identity integrity agenda and the privacy rights of more than 12 million Canadians. Genetic information: The OPC provided input to Parliament as part of its review of the DNA Identification Act, and also co-sponsored with Genome Canada a successful workshop that engaged other federal partners on consent issues related to biobanks (http://www.priv.gc.ca/speech/2009/sp-d_20091127_e.cfm).	Met all
3. Strategically advance global privacy protection for Canadians	Previous	The OPC participated actively in meetings of the Organisation for Economic Co-operation and Development (OECD) and continued its involvement in promoting privacy protection within the Asia-Pacific Economic Co-operation (APEC) economies. Both the OECD and APEC are developing mechanisms to encourage and facilitate co-operation among enforcement authorities. As well, a member of the OPC's research staff was seconded to the OECD to support the Organisation's reassessment of the influential OECD Privacy Guidelines. The Office collaborated with the U.S. Federal Trade Commission on a complex investigation of an Internet-based data broker engaged in transborder activities, and offered support in related litigation by filing an amicus curiae ("friend of the court") brief. In November 2009, the Assistant Commissioner delivered a speech at the 31st International Data Protection Commissioners Conference in Madrid where dozens of the world's data protection authorities endorsed a draft international standard on privacy protection. In conjunction with that event, the OPC also took part in the Third Conference of Francophone Personal Data Protection Commissioners. As well, the Office contributed to the development of the Memorandum of Montevideo, signed by various Latin American countries. The Memorandum offers guidelines for legislators, government institutions, businesses and educational institutions in Latin America as they develop policies, programs and practices aimed at protecting youth privacy on the Internet. In addition to a continuing role with the International Standards Organisation (ISO), the OPC has taken on new responsibilities with membership in the ISO Technical Management Board Privacy Steering Committee and participates in an ISO subcommittee on biometrics.	Met all
4. Support Canadians, organizations and institutions to make informed privacy choices4	Previous	During 2009-2010, the OPC expanded its public education activities in Atlantic Canada and Ontario, while also producing additional resource materials for small business owners and other target markets. As well, the Office broadened its information technology assets to analyse new business models and evolving technologies. The OPC developed new guidance and information for Canadians and organizations on a variety of privacy issues. There was a significant increase in requests for these materials, as evidenced by hits to the OPC website, the distribution of publications, and an increase in speaking engagements (refer to section 2.3 of this report for more information). The Office, in consultation with provincial and territorial counterparts, published guidelines for administrative tribunals in relation to the disclosure of personal information during the publication of their decisions on the Internet (www.priv.gc.ca/information/pub/gd_trib_201002_e.cfm). In 2009-2010, the Office made 14 appearances before parliamentary committees to comment on the privacy implications of new legislation or ongoing programs (refer to section 2.2 of this report).	Met all
5. Enhance and sustain the organizational capacity	Previous	With an increase in funding in 2008, the OPC continued its efforts to meet rising demand by building human resource and infrastructure capacity. The OPC continues to implement its 2008-2011 Integrated Business and Human Resources Plan. An Employee Toolkit and a Managers' Toolkit were developed to help orient employees within the organization and the government environment. The OPC continues to favour the use of online knowledge assessments, managed through a web portal, to support its recruitment efforts. The Office enhanced its communications strategy for recruitment, notably by launching a video on YouTube that highlighted vacant positions and the OPC work environment. (The video is also accessible through the Public Service Commission's jobs.gc.ca web portal.) The Office also used new communication media such as blogs and Twitter to advertise openings that have been difficult to fill in the past. This contributed to the recruitment of a highly skilled workforce able to support the OPC's research and investigative efforts involving the privacy implications of sophisticated information technologies (IT). The OPC improved job postings used to attract Co-op and Federal Student Work Experience Program students in IT. By presenting opportunities with minimal bureaucratic terms and by including testimonials of previous students employed at the OPC, the Office successfully recruited students with high academic achievements for each placement of the school year. After an intensive two-year effort, a new case management system was rolled out in September 2009 in order to enhance organizational capacity. The system allows the OPC to track complaints, monitor the investigation process and analyze trends. The system and related IM/IT initiatives will help streamline the investigation and other processes. Several SharePoint sites were built across the OPC to increase information sharing and collaboration within the Office for specific business needs such as the organization and reporting of national consumer consultations. An information technology lab platform was configured to support the OPC research team. A new desktop security suite was provided to all staff.	Met all

The OPC is satisfied that all commitments made to advance its five corporate priorities, as published in the 2009-2010 Report on Plans and Priorities, were "all met".

Risk Analysis

External Factors

Thirty years ago, the members of the Organisation for Economic Co-operation and Development agreed on a common set of guidelines for the protection of privacy and transborder data flows. These guidelines helped set the stage for a broad array of privacy and data protection legislation enacted in many OECD countries during the intervening years. Canada's own private-sector privacy legislation draws from this common heritage. In recent years, the OPC has been challenged to apply this legislation to a global business environment that seeks to collect and interpret increasing amounts of information about its users and clients. Canada's public-sector privacy legislation dates from the same era, and faces similar pressures.

In the private sector, demographic data, product preferences, search histories and countless other details not only inspire innovative new products and processes, but also make users more susceptible to behavioural targeting and profiling on the basis of economic and social analysis.

In the public sector, meanwhile, Canadians are confronted with a never-ending stream of demands to verify their identity and reassure authorities that they are upstanding members of society. Technology and tactics originally implemented abroad, such as automated licence plate recognition, closed-circuit television networks, radio frequency identification (RFID)-equipped identity documents and invasive border security techniques, are finding their champions among Canadian intelligence and security authorities.

Indeed, whether to enhance efficiency, increase national security, rationalize social services or strike international information-sharing agreements, the government seeks continually to expand the amount of data it holds on its citizens. As a result, Canadians frequently encounter circumstances where they feel their privacy rights are being undermined.

The OPC recognizes that international cooperation is essential to push for increased respect for privacy rights from public-sector authorities and improved data protection among private-sector organizations. As such, the Office is working with international counterparts to address the privacy challenges facing Canadians today.

The OPC also works with researchers, advocates and academics to understand technological and social solutions to these challenges. The Office, moreover, is examining how to provide Canadians with appropriate information and tools to help them counter demands for their personal information.

When required, the OPC marshals its legislative powers to effect change by domestic and international organizations. Recent investigations by the Office demonstrated that the strategic application of these legislative authorities can, in fact, compel change.

The rapid progress of technology, however, is challenging traditional approaches to privacy protection. In an environment where a smart phone can relate locational data to pictures, voice messages, Internet use history and other activities, how do we define personal information? As genetic testing procedures drop in price but rise in accuracy, how do we ensure continuing data protection? In either case, how do we ensure that Canadians have the opportunity to provide their informed consent?

Authorities such as the OPC must continue to develop tools to confront institutional and technical challenges to privacy and data protection rights. This demands ongoing engagement with provincial, territorial and international authorities, constant monitoring of business trends and product developments, insight into intelligence and security threats, and technological expertise.

Key Risks

In this turbulent environment, the OPC manages risks to the successful delivery of its responsibilities. The three most critical risks faced in 2009-2010 follow, along with the mitigating measures used to manage the risks:

First, the OPC continues to have more business demands than it can handle. This creates the risk that the Office may not meet all of its mandated requirements. To reduce capacity challenges and improve service delivery, the OPC re-engineered its complaint investigation processes; implemented a new case management system; eliminated its longstanding backlog of complaints, and continued focusing efforts on four priority privacy issues (information technology, national security, identity integrity and protection, and genetic information). Nevertheless, the Office remains vulnerable as demands continue to increase. Government-wide capacity challenges continue to drive the human resources strategies. Implementation of the OPC Integrated Business and Human Resources Plan 2008-2011 is proving to be effective and has resulted in a more stabilized workforce. Recruitment efforts continue to reach out to a broader pool of candidates.

Second, protecting data from unauthorized disclosure has been a continuous challenge for the OPC, just as it would be for any organization that depends on technology to manage operations. The OPC has information technology (IT) security and related controls in place to address this challenge. These include compliance with the Treasury Board Policy on Government Security; regular Access to Information Act and security of information training for personnel; enforcement and review of the OPC information management and IT policies, directives and practices; safeguards of licences for information management and IT products; keeping perimeter defences current; use of encrypted USB data storage devices where appropriate; enhanced security measures for visitors to the building; security patrols for safeguarding assets and information; new and improved security access keys for all closed offices and perimeter entrance doors; reinforced security for all new servers; periodic enterprise threat and risk assessment, and approval of a business contingency plan.

Third, the Privacy Act is not up to date and does not offer sufficient recourse when there are privacy breaches. A comprehensive reform of the Act is long overdue. Since 2008, when the House of Commons Standing Committee on Access to Information, Privacy and Ethics commenced a review of the Act and the Privacy Commissioner proposed a list of 10 "quick fixes" as a first step in modernizing the law, the government has not introduced new legislation. This remains a risk, but the OPC cannot act further upon it, other than to continue to remind Parliament of the importance of this issue for Canadians.

Expenditure Profile

The OPC Main Estimates and Planned Spending amounts have increased steadily since 2007-2008, including approved funding from Business Case II of $3.064 million in 2008-2009 and $4.295 million in 2009-2010 to address the backlog of privacy investigations, expand public outreach and implement the internal audit initiative. The backlog was eliminated as of March 31, 2010, many public outreach initiatives were directed at businesses and other target groups, such as small businesses and youth, and the OPC now has an internal audit function.

There is no significant difference between the Main Estimates and the Planned Spending amounts, which are presented as a single figure. The variance between the Planned Spending and the Total Authorities is due to compensation for collective agreements and funding carried forward from the previous year. Actual spending reflects the same trend as the funding. As such it was lower in 2007-2008 than in 2008-2009 and 2009-2010, due to funding granted in Business Case II.

Voted and Statutory Items

This table shows the voted items that Parliament approved through the Main Estimates with its supply bills. The statutory items are displayed for information purposes only.

($ 000)		2007-2008	2008-2009	2009-2010
Vote or Statutory Item	Truncated Vote or Statutory Wording	Actual Spending	Actual Spending	Planned Spending/Main Estimates	Total Authorities	Actual Spending
45	Program expenditures	15,677	20,473	20,101	21,691	20,521
(S)	Contributions to employee benefit plans	1,453	1,664	2,222	2,119	2,119
Total		17,130	22,137	22,323	23,810	22,640

The increase of $0.5 million in Actual Spending between 2008-2009 and 2009-2010 is mainly attributable to changes stemming from the collective agreement (i.e., salaries and corresponding contributions to employee benefit plans).

Section II: Analysis by Program Activity

OPC Performance in 2009-2010

Strategic Outcome: The privacy rights of individuals are protected.

Expected Result	Performance Indicator
Ultimate Outcome for Canadians
The OPC plays a lead role in influencing federal government institutions and private-sector organizations to respect the privacy rights of individuals and protect their personal information.	Extent and direction of change in the privacy practices of federal government institutions and private-sector organizations.

In its 2009-2010 Report on Plans and Priorities, the OPC undertook to start reporting on its Strategic Outcome in 2010-2011. Application of the associated performance indicator (gauging the extent and direction of change in the privacy practices of federal government institutions and private-sector organizations) will reveal whether the OPC is achieving the outcome it expects - to play a lead role in influencing federal government institutions and private-sector organizations to respect the privacy rights of individuals and protect their personal information.

Progress toward the Strategic Outcome is already informed by the performance achieved under the four Program Activities of the OPC Program Activity Architecture. For each Program Activity, sub-sections 2.1 to 2.4:

• describe what is involved in the Program Activity (defined as per the implementation of the TBS Management, Resources and Results Structure Policy);
• report on planned versus actual resource use in 2009-2010;
• present a summary of the OPC actual performance in relation to expected results and performance indicators/targets, and include a performance status against the TBS scale (refer to Section 1.2 for a description of the scale), and
• provide an overall analysis of the OPC performance in 2009-2010, discuss lessons learned from the past year's performance, and articulate the benefits that Canadians derive from the activities delivered by the OPC.

2.1 Program Activity 1: Compliance Activities

Activity Description

The OPC is responsible for investigating complaints and responding to inquiries received from individuals and organizations that contact the OPC for advice and assistance on a wide range of privacy-related issues. The OPC also assesses, through audits and reviews, how well organizations are complying with requirements set out in the two federal privacy laws, and provides recommendations on privacy impact assessments (PIAs) pursuant to the Treasury Board Secretariat policy. This activity is supported by a legal team that provides specialized legal advice and litigation support, and a research team with senior technical and risk-assessment support.

Program Activity 1: Compliance Activities

2009-2010 Financial resources ($000)			2009-2010 Human resources (FTEs)
Planned Spending	Total Authorities	Actual Spending	Planned	Actual	Difference
9,410	10,414	9,881	81	68	(13)

Expected Results	Performance Indicators/Targets	Actual Performance	Performance Status
Intermediate Outcomes
Individuals receive effective responses to their inquiries and complaints.	Indicator: Timeliness of OPC responses to inquiries and complaints Target: Refer to footnote5	The Office responded to 7,821 inquiries (oral and written) in 2009-2010, 92 percent within the 30-day service standard. Inquiries that were not responded to within the service standard were often more complex and required legal opinions or additional information to respond to the client. For complaints, timeliness is measured in two ways: the reduction of the backlog of complaints older than one year from the date of receipt, and the treatment time to process a complaint. An unprecedented effort was invested in 2009-2010 to eliminate the backlog of older complaint files. By March 31, 2010, the backlog was eliminated - a major milestone for the Office. The calculation of treatment time to process a complaint is based on the average number of months between the date of receipt of the complaint and the date when findings are made or the issue is resolved in some other way. The closure of numerous old files resulted in average treatment times for 2009-2010 that were still very high: Complaints under PIPEDA: 18 months on average to close 576 complaints in 2009-2010, compared to 20.9 months last year. Complaints under the Privacy Act: 15 months on average to close 1,154 complaints in 2009-2010, compared to 19.5 months the year before..	Mostly met
Federal government institutions and private-sector organizations meet their obligations under federal privacy legislation and implement modern principles of personal information protection.	Indicator: Extent to which investigation and audit recommendations are accepted and implemented over time Target: 90% of investigation recommendations are accepted and implemented	Investigations under the PIPEDA Under the PIPEDA, the Commissioner made recommendations through the Reports of Findings in 56 cases in 2009-2010. Recommendations were fully accepted and implemented in 35 cases (62.5 percent) and accepted and partially implemented in eight more cases (for a total of 77 percent). With respect to the 13 cases where recommendations were not accepted, in 3 of the cases, the Office filed an application in Federal Court to have the Commissioner's recommendations enforced (two of these are ongoing, while one was settled); in the other cases, the OPC decided not to proceed to Federal Court on the basis of a variety of considerations, including that the OPC did not have the power to proceed to Federal Court or the responding organization had ceased to exist. Investigations under the Privacy Act Under the Privacy Act, informal recommendations are normally made throughout the investigation process and responded to prior to the end of the investigation. In 2009-2010, the Commissioner made formal recommendations in the Report of Findings in 11 cases. The respondents accepted the recommendations in nine cases (82 percent) and, to-date, recommendations have been implemented in one of the nine cases. In the other eight cases, sufficient time has not passed to allow for implementation. The OPC will follow up with the organizations to record the implementation of its recommendations.	Somewhat met
	Target: 90 percent of audit recommendations are accepted fully by entities; upon re-audit, two years after the initial report, action to implement has begun on 90 percent of recommendations	Of the five audits6 that were completed during 2009-2010, 30 recommendations were made and 29 (97 percent) were accepted by the audit entities at the time of reporting. Follow-up is made two years after audit reports are issued to determine the rate of implementation of the recommendations. Of the 21 audit recommendations verified during 2009-2010, action had begun on all (100 percent).	Exceeded
Federal government institutions and private-sector organizations meet their obligations under federal privacy legislation and implement modern principles of personal information protection.	Indicator: OPC recommendations that are not resolved through the investigation process are advanced before the courts, where possible Target: OPC recommendations advanced before the courts are either settled to the satisfaction of the Commissioner or there is a court decision elaborating the law	From April 1, 2009 to March 31, 2010, the OPC was involved in 14 litigation cases related to PIPEDA and five cases related to the Privacy Act in order to promote compliance with federal privacy legislation. Most of these cases are still before the courts. Two cases were settled to the satisfaction of the Commissioner and the parties. In another case, the court rendered a judgment that clarified legal obligations, thus facilitating compliance with privacy legislation.	Met all
Immediate Outcomes
The process to respond to inquiries and investigate complaints is effective and efficient.	Indicator: Timeliness of OPC responses to inquiries and complaints	Refer to performance information for the same indicator earlier in this table.	Mostly met
The process to conduct audits and reviews is effective and efficient, including effective review of privacy impact assessments (PIAs) for new and existing government initiatives	Indicator: Extent to which audit recommendations are accepted and implemented over time	Refer to performance information for the same indicator earlier in this table.	Exceeded
The process to conduct audits and reviews is effective and efficient, including effective review of privacy impact assessments (PIAs) for new and existing government initiatives	Indicator: Proportion of audits and PIA reviews completed within planned times Target: 50% of audits are completed within planned times and 50% of PIA reviews are completed within 90 days of receipt	Five audits and one follow-up to an audit were completed in 2009-2010, all within their planned timelines. Note that some changes were made to the risk-based audit plan during the year for several reasons: a follow-up to the audit of the PIA function was cancelled due to the impending change in the TBS PIA directive; a follow-up to the Royal Canadian Mounted Police Exempt Data Bank Operations Audit was deferred until 2010-2011 and, upon further consideration, a planned audit of secure channel operations was cancelled and replaced by an audit that examines the disposal practices of selected federal entities. Potential audits of Integrated Border Enforcement Teams, Public Safety Canada, the Canadian Air Transport Security Authority and Trusted Traveller Programs that were originally planned for 2009-2010 are being assessed and considered as part of developing the next risk-based audit plan. The audit plan will be completed in 2010-2011. During 2009-2010, the OPC received a total of 102 PIAs, which represents a significant increase from the 64 received in the previous reporting period. This year, the OPC began to implement a triage process for PIAs to focus limited resources on reviewing higher-risk initiatives, which led to improved timeliness in the PIA reviews. The Office sent out 33 letters of recommendation; 23 (or 70 percent) of those reviews were completed within the 90-day standard that the OPC strives for to provide institutions with timely and relevant advice.	Met all
	Indicator: Responsiveness of (or feedback from) federal government departments and private-sector organizations7 to OPC advice relating to privacy rights and obligations and PIAs Target: 75 percent of institutions and organizations are responsive to the OPC advice	In 2009-2010, the Office sent out 33 letters of recommendation at the conclusion of PIA reviews and, in 79 percent of these cases, federal institutions responded favorably in whole or in part to the OPC advice, proposed mitigating measures and/or recommendations. Federal institutions are not obliged to respond to the OPC's PIA reviews. Moreover, when entities to respond, agreement is not always explicitly outlined. The Office, however, has observed an increasing level of engagement and co-operation during the PIA process.	Exceeded

Performance Analysis

The Office eliminated the backlog of older complaint files that had persisted for several years. The average treatment time to complete investigations remains high as a result of the many backlogged files that were closed during 2009-2010. The Office is confident that treatment times for the next reporting period will improve considerably.

The majority of the Commissioner's investigation recommendations were accepted and implemented by federal institutions and private-sector organizations (allowing sufficient time after the completion of investigations), although the high performance target of 90 percent was only somewhat met. The high level of litigation activity in the past fiscal year demonstrates the OPC's ongoing commitment to pursue court enforcement of recommendations that are not resolved through the investigation process.

The investigation process was re-engineered during the year and a new case management system was implemented to support the realigned processes. The audit and PIA work, for which new methods were applied, progressed satisfactorily.

Lessons learned

Considering the significant effort that led to the elimination of the complaint investigation backlog and the introduction of a re-engineered investigative framework during the same time period, the OPC has planned a review for early in the next fiscal year to identify and integrate lessons learned to further improve processes and practices. As well, service standards for inquiry and investigation activities will be set in 2010-2011.

The number of PIA reviews completed during the year (33, compared to 31 in 2008-2009) has not increased substantially. However, the PIA function continues to be improved through the implementation of a new triage process; completion of an internal transformation in the way PIA reviews are conducted; the addition of new staff, and increased outreach to institutional officials.

Benefits for Canadians from this Program Activity

In responding to inquiries, the OPC informs Canadians of their privacy rights. In conducting complaint investigations, audits and PIA reviews, the Office establishes whether government institutions and private-sector organizations plan to and/or collect, use, disclose, retain and dispose of Canadians' personal information in accordance with the privacy protections set out in the two federal privacy laws. Where non-compliance is identified, the OPC takes action to influence change. Investigating one individual's privacy complaint can have a huge impact when it leads to improvements that affect many Canadians.

2.2 Program Activity 2: Research and Policy Development

Activity Description

The OPC serves as a centre of expertise on emerging privacy issues in Canada and abroad by researching trends and technological developments; monitoring legislative and regulatory initiatives; providing legal, policy and technical analyses on key issues, and developing policy positions that advance the protection of privacy rights. An important part of the work done involves supporting the Commissioner and senior officials in providing advice to Parliament on potential privacy implications of proposed legislation, government programs and private-sector initiatives.

Program Activity 2: Research and Policy Development

2009-2010 Financial resources ($000)			2009-2010 Human resources (FTEs)
Planned Spending	Total Authorities	Actual Spending	Planned	Actual	Difference
4,288	4,558	4,067	17	22	5

Expected Results	Performance Indicators/Targets	Actual Performance	Performance Status
Intermediate Outcome
Parliamentarians and key stakeholders have access to clear, relevant information and timely and objective advice about the privacy implications of evolving legislation, regulations and policies.	Indicator: Parliament and sponsoring departments have been provided with the OPC views on the privacy implications of relevant laws, regulations and policies in progress Target: Where appropriate, OPC views on the privacy implications of legislation, regulations and policies are made available to stakeholders in a timely fashion	In 2009-2010, the OPC made 14 appearances before parliamentary committees to provide views and advice on the privacy implications of new legislation or ongoing programs. Topics and issues included reform of the Privacy Act, the National Sex Offender Registry, the National DNA Databank, and the regulatory environment around the Canadian wireless sector. (More detail on appearances can be found at http://www.priv.gc.ca/parl/ index_e.cfm). At all appearances, committees expressed appreciation for the OPC's perspective. The Office reviewed the privacy implications of 10 new bills during the fiscal year. They related to a range of issues, including new measures to combat identity theft and spam e-mail, a proposal to overhaul Canada's search and surveillance laws, and tracking pathogens and adverse drug reactions in the Canadian population.	Met all
Immediate Outcomes
The work of Parliamentarians is supported by an effective capacity to identify and research privacy issues, and to develop policy positions for the federal public and private sectors, which are respectful of privacy.	Indicator: Parliament and sponsoring departments have been provided with the OPC views on the privacy implications of relevant laws, regulations and policies in progress Target: Where appropriate, OPC views on the privacy implications of legislation, regulations and policies are made available to stakeholders in a timely fashion	In addition to appearances before parliamentary committees, the OPC had 45 other interactions - meetings, teleconferences, formal briefings or correspondence - with individual parliamentarians on matters of privacy and data protection. A range of privacy concerns were reflected in these discussions, from new ‘know your customer' measures being required of the financial services sector to the use of body-scanning technologies at airport checkpoints. OPC interactions with parliamentarians were generally well-received and the Office's input on privacy issues appreciated. During the reporting period, the OPC issued policy guidance through 18 submissions, factsheets and papers. These dealt with the privacy rights of Canadian travellers; how the Canadian Radio-television Telecommunications Commission (CRTC) determines expectation of privacy around customer information; industry use of deep packet inspection (DPI) technologies; changes to Canada's legal framework around surveillance, and the risks of social media for businesses. The OPC conducted internal reviews of 61 government initiatives and 17 private-sector policies during 2009-2010, providing policy positions that advance the protection of privacy rights.	Met all
Knowledge about systemic privacy issues in Canada is enhanced through research, with a view to raising awareness and improving privacy management practices.	Indicator: Stakeholders have had access to, and have considered, OPC research products and outreach materials them in their decision-making Target: Initiatives related to all four OPC priority privacy issues have involved the relevant stakeholders and there is documented evidence that they were impacted by the OPC research products and outreach materials	The Office has increased channels used to distribute the results of research by organizing workshops, sponsoring seminars and encouraging the presentation of research efforts at industry and learning events. Examples include three joint colloquia with Genome Canada on genetic information; research to analyze behavioural targeting by organizations that culminated in a workshop; public opinion information on geospatial privacy from an NRCan GeoConnections research, and two workshops on privacy and geolocation technologies organized by the Office and involving government, industry and advocacy stakeholders. Research examined locational technology, biometrics, legislative options for ensuring child privacy, as well as the protection of privacy rights during the 2010 Vancouver Olympic and Paralympic Games. Online tools such as the OPC blog (http://blog.privcom.gc.ca/) play an important role in making research broadly available. In 2009-2010, the Office updated the privacy quiz (http://priv.gc.ca/ quiz/index_e.cfm) destined for small businesses, and also made Qs and As on FINTRAC available (http://priv.gc.ca/resource/ t_faqs_index_e.cfm). The OPC continued to refresh material available on the "Legal Corner" pages of its website to inform Canadians about legal developments and what they mean for their day-to-day lives. For example, a recent addition discusses privacy issues related to cloud computing (http://www.priv.gc.ca/ information/pub/cc_201003_e. cfm#toc2a). A statutory evaluation of the OPC Contributions Program was completed, including consultations with stakeholders, and the mandate for the Program was renewed. In 2009-2010, 11 organizations across Canada received funding for research in one or more of the priority privacy issue areas, for a total of $454,697 (http://www.priv.gc.ca/media /nr-c/2009/nr-c_090529_cp_e.cfm).	Met all

Performance Analysis

The Office has seized upon opportunities to promote public discussion of contemporary privacy issues. As a result of the investigation into Facebook, a considerable amount of research was conducted into privacy attitudes around social networking and child privacy online. Other research projects encouraged the study of privacy in relation to the 2010 Vancouver Olympic and Paralympic Games, and surveillance in general.

Lessons learned

In staffing positions, the Office has favoured candidates with technical skills, familiarity with new media, and experience in collaborative work environments. In 2009-2010, the OPC hired a parliamentary affairs officer as well as a student through the Federal Student Work Experience Program (FSWEP). As well, the OPC continues to seek opportunities to partner with other public, private, and not-for-profit organizations with similar goals of promoting privacy protection.

Benefits for Canadians from this Program Activity

By examining federal programs and policies that touch on privacy, business processes that affect information security, and innovative technologies that pose challenges to personal privacy, the OPC is helping raise awareness of privacy issues among Canadians. Through its research programs, the Office also advances knowledge about privacy issues, in Canada and abroad, among institutions, businesses and the public.

2.3 Program Activity 3: Public Outreach

Activity Description

The OPC delivers a number of public education and communications activities including speaking engagements and special events, media relations, and the production and dissemination of promotional and educational material. Through public outreach activities, individuals have access to information about privacy and personal data protection that enables them to protect themselves and exercise their rights. The activities also allow organizations to understand their obligations under federal privacy legislation.

Program Activity 3: Public Outreach

2009-2010 Financial resources ($000)				2009-2010 Human resources (FTEs)
Planned Spending		Total Authorities	Actual Spending	Planned	Actual	Difference
3,585		3,592	3,213	23	22	(1)

Expected Results	Performance Indicators/Targets	Actual Performance	Performance Status
Intermediate Outcomes
Individuals have relevant information about privacy rights and are enabled to guard against threats to their personal information.	Indicator: Reach of target audience with OPC public education and communication activities Target: 100 citations of OPC officials on salient privacy issues per year; at least 100,000 hits on the OPC website and 10 comments on OPC blogs per month; at least three speeches/ events per month, reaching a minimum of 1,000 persons in total; at least 1,000 publications sent per year; and an average of one news release per month	OPC officials were cited in the media thousands of times on hot privacy issues - in Canada and around the world. Topics included social networking and the OPC's investigation of Facebook; privacy and street-level imaging applications such as Google Street View; Bills C-46 and C-47, and millimetre-wave scanners at airports. More than 30 press releases were disseminated on a variety of issues, such as the OPC's annual reports and public-sector audits, national poll results, the OPC's consultations, the Facebook probes and Google Buzz. The OPC produced about 30 distinct tools and publications, including annual reports and audits, as well as guidance for businesses and individuals on, for example, street-level imaging, social networking in the workplace, covert video surveillance, truncating credit card numbers on receipts, and security measures in air transportation. The OPC also produced other tools to raise awareness, including editorial cartoons and illustrations on a range of privacy issues and an instructional video for businesses. In 2009-2010 the OPC had more than 2 million hits to its website, an increase from 1.7 million the year before. Approximately 16,000 publications were distributed in 2009-2010, up from 13,000 the year before. One distribution campaign was targeted specifically at the ATIP community. The number of speeches delivered by OPC officials rose by nearly 50 percent, to 199 in 2009-2010 from 135 the previous year. The OPC's youth privacy website, created in 2008-2009, was refreshed with additional material, including a revitalized blog and tip sheets, animated videos and lesson plans geared variously to youth, parents and teachers. The second year of the Youth Privacy Video contest saw a doubling of participation by students across Canada. The OPC has begun to build relationships with national associations representing teachers and librarians, and is developing more public education materials for young Canadians, their parents and teachers.	Exceeded
Federal government institutions and private-sector organizations understand their obligations under federal privacy legislation.	Indicator: Responsiveness of (or feedback from) federal government departments and private sector organizations to OPC advice relating to privacy rights and obligations and PIAs Target: 75 percent of institutions and organizations are responsive to the OPC advice	The OPC received 102 new PIA submissions in fiscal 2009-2010. Not all PIA reviews result in letters of recommendations. During the reporting period, the Office sent out 33 letters of recommendation and, in 79 percent of these cases, federal institutions responded favorably in whole or in part to the OPC advice, mitigating measures and/or recommendations. Federal institutions are under no obligation to respond to the OPC PIA reviews or to implement PIA recommendations. The Office, however, observes a higher level of engagement and co-operation from departments during the PIA process.	Exceeded
	Indicator: OPC had a positive influence on the development of relevant jurisprudence and policy resulting in clearer legal obligations of government institutions and private-sector organizations Target: Courts and Commissioners of Inquiry have heard and considered OPC arguments	The OPC was involved in three matters before the courts in the past year, which resulted in positive developments for privacy. In the first, the OPC supported the U.S. Federal Trade Commission (FTC) by participating as amicus curiae in litigation before the American courts. The FTC was successful in this matter, and the decision of the U.S. Court of Appeals was consistent with the submission of the OPC. The OPC was also involved in two matters before the Federal Court of Canada that resulted in successful settlements, thereby enhancing compliance with privacy legislation.	Met all
Immediate Outcomes
Individuals receive and have easy access to relevant information about privacy and personal data protection, enabling them to better protect themselves and exercise their rights.	Indicator: Reach of target audience with OPC public education and communication activities	Refer to performance information for the same indicator earlier in this table.	Exceeded
	Indicator: Extent to which individuals know about the existence/role of the OPC, understand their privacy rights, and feel they have enough information about threats to privacy Target: At least 15 to 20 percent of Canadians have some awareness of the OPC; at least 15 to 20 percent of Canadians have at least an "average" level of understanding of their privacy rights; and at least 35 to 40 percent of Canadians have some level of awareness of the privacy threats posed by new technologies	In March 2009, the OPC conducted a public opinion poll (published in early 2009-2010). Among the findings were: One third (33 percent) of Canadians were aware of federal institutions that help protect personal information. Of those, nearly one in five (18 percent) were aware of the OPC. Twenty-eight percent of Canadians rated their knowledge of privacy rights as good or very good, up significantly from 13 percent in 2001. Conversely, the proportion who rated their knowledge as poor or very poor dropped substantially from 60 percent to 35 percent since the question was asked in a 2001 poll. Canadians appear to be less confident that they understand the impact of new technologies on their privacy. Only 45 percent said they felt that they had enough information to know how their privacy could be affected by new technologies, a decline of six percentage points in just two years. To view the complete report: http://www.priv.gc.ca/information /survey/2009/ ekos_2009_01_e.cfm	Met all
Federal government institutions and private-sector organizations receive useful guidance on privacy rights and obligations, contributing to better understanding and enhanced compliance.	Indicator: Reach of organizations8 with OPC policy positions, promotional activities and promulgation of best practices Target: 100 citations of OPC officials on salient privacy issues per year; at least 100,000 hits on the OPC website and 10 comments on OPC blogs per month; at least three speeches/ events per month, reaching a minimum of 1,000 persons in total; at least 1,000 publications sent per year; and an average of one news release per month	In 2009-2010, the OPC launched nine new guidance documents -- one related to the Office's role and mandate, five related to PIPEDA matters (for example, social networking in the workplace, street-level imaging and covert video surveillance) and three related to public-sector privacy issues (privacy and the Olympics, aviation and border security measures, and individuals' rights in the public sector). The OPC also produced new tools to assist businesses in safeguarding customer personal information, such as a video on PIPEDA responsibilities for small businesses. The Office also continued to make available the popular PIPEDA guide for businesses, as well as the guide for individuals (http://priv.gc.ca/resource/ io_pr_e.cfm). The OPC continued to produce and disseminate its e-newsletter, which now has more than 800 subscribers. The OPC published an innovative series of essays on deep packet inspection (http://dpi.priv.gc.ca). It also commissioned a comprehensive review of research literature on child privacy, and supported a workshop in Fredericton on the subject. In addition, the Office organized a workshop on surveillance, privacy and the 2010 Vancouver Olympic Games. Poll results from research conducted in 2009-2010 and published in early 2010-2011 demonstrated favourable results with respect to increased levels of awareness and understanding among businesses about their responsibilities under PIPEDA. (http://www.priv.gc.ca/ information/survey/2010/ ekos_2010_01_e.cfm) The OPC consulted with and/or provided guidance to federal departments and agencies with respect to issues such as PIPEDA review, enhanced drivers licences, lawful access, personal health information, spam and spyware, and the no-fly list. The OPC also engaged with business groups on issues such breach notification, privacy policies, outsourcing and data security. Discussions continued with the Canada School for Public Service on the creation of targeted privacy training for federal public servants. The OPC blog (http://blog.privcom.gc.ca/) continues to be referenced by stakeholders, and the OPC's new account on messaging application Twitter (http://www.twitter.com/ privacyprivee) has proven valuable in engaging Canadians on issues of immediate interest.	Met all

Performance Analysis

The OPC's public education activities, especially presentations to primary and secondary schools as well as small business organizations, have been well received across the country. The Office has found online and social media tools increasingly important, enabling the Office to establish a dialogue on contemporary issues with individual Canadians and interested stakeholders.

As detailed in the table above, the OPC enhanced its audience reach in 2009-2010 with considerably more speeches delivered to conferences and other events across Canada, and more guidance documents and others publications developed and distributed. As well, the Office issued 61 news releases and other communications tools and conducted more than 300 media interviews.

In 2009-2010, the OPC also committed to providing information and tools to disadvantaged communities⁹ . Toward that end, the Office funded through its Contributions Program an awareness campaign on the Canadian privacy protection framework for official language minorities; awareness seminars on identity theft and privacy protection for seniors; and a public education campaign for Canadians with hearing impairments.

Lessons learned

The OPC's use of traditional and non-traditional communications tools and channels has raised awareness of privacy issues among a variety of stakeholder groups, including the media. The Facebook probe had a dramatic impact on public awareness of privacy issues in 2009-2010.

The Office's outreach activities in Atlantic Canada have strengthened relationships with provincial colleagues and raised awareness of privacy rights and obligations in the region. These activities were complemented by communications activities to further strengthen federal-provincial-territorial initiatives, such as joint statements, media activities, and the development of guidance. The OPC is extending its regional activities by opening an office in Toronto in the next fiscal year.

Benefits for Canadians from this Program Activity

By raising organizations' awareness of their obligations under federal privacy laws and furnishing them with tools and information to better protect the personal information in their care, the OPC is helping to strengthen the privacy protections enjoyed by Canadians. The Office also directs communications and outreach activities specifically at individuals, thus heightening their awareness of their rights and abilities to exercise them. With a better understanding of the issues, Canadians are also better equipped to protect their personal information and reduce their privacy risks.

2.4 Program Activity 4: Internal Services

Activity Description

Internal Services are groups of related activities and resources that support an organization's programs and other corporate obligations. As a small entity, the OPC's Internal Services include two sub-activities: governance and management support, and resource management services (which also incorporate asset management services). Given the specific mandate of the OPC, communications services are not included in Internal Services but rather form part of Program Activity 3 - Public Outreach. Similarly, legal services are excluded from Internal Services at the OPC, given the legislated requirement to pursue court action under the two federal privacy laws. Legal services form part of Program Activity 1 - Compliance Activities, and Program Activity 2 - Research and Policy Development.

Program Activity 4: Internal Services

2009-2010 Financial resources ($000)			2009-2010 Human resources (FTEs)
Planned Spending	Total Authorities	Actual Spending	Planned	Actual	Difference
5,040	5,246	5,479	46	46	0

Expected Results	Performance Indicators/Targets	Actual Performance	Performance Status
The OPC achieves a standard of organizational excellence, and managers and staff apply sound business management practices.	Indicator: Ratings against Management Accountability Framework - MAF Target: Strong or acceptable rating on 70 percent of MAF areas of management	As an Officer of Parliament, the OPC is not subject to a MAF assessment by Treasury Board Secretariat. Nonetheless, the Office conducts a comprehensive self-assessment exercise against the MAF biennially, and a status update on improvements in the intervening years. The OPC uses this exercise as a report card on its ‘state of management'. Since the self-assessments started, there has been continuous progress in the OPC state of management: in 2006-2007, 40 percent of MAF management areas were either strong or acceptable; in 2008-2009, it was 60 percent; and the October 2009 status update indicates an 80 percent rating. Areas where OPC's management practices10 met or exceeded MAF expectations were: values-based leadership and organizational culture; corporate performance framework; corporate management structure; quality of analysis in Treasury Board submissions; quality and use of evaluation; quality of performance reporting; corporate risk management; fair workplace; sustainable workforce; information management; IT management; project management; procurement; financial management and control; internal audit, and alignment of accountability instruments. Areas where OPC still had opportunities for improvement when the last self-assessment was completed were: managing organizational change; asset management; management of security and business continuity; and citizen-focused service. Since then, the improvement required in the management of security and business continuity has been addressed, and the Office has planned activities to address the other areas in 2010-2011. The fall 2008 Public Service Employee Survey (results were analyzed and published in 2009-2010), in which 65 percent of OPC staff participated, indicated that employees were committed to providing a high level of service to Canadians. When employees leave the OPC, they are encouraged to complete an exit questionnaire. Results from questionnaires completed in 2009-2010 show that the primary reason for departures was to gain better future career/advancement opportunities. Overall, a high level of satisfaction was expressed by departing employees with respect to values and ethics of management; working conditions (office environment); autonomy; policies and procedures, and hours of work. The OPC introduced an Awards and Recognition Program in the past year to formally recognize the contributions of staff.	Exceeded

Performance Analysis

The MAF self-assessment exercises demonstrate that the OPC continues to improve its management framework with more rigorous processes, practices, controls and tools. More work is required, however, particularly to review and set service standards for investigations, now that the major re-engineering work is complete.

In addition to the 2009-2010 achievements noted in the above table, the OPC:

• continued implementing its Integrated Business and Human Resources Plan, which effectively addressed issues such as employee orientation and specialized training, and stabilized the workforce;
• implemented commitments from the second year of the 2008 Business Case II, particularly addressing issues of capacity in compliance activities: starting in February 2010, 20 new inquiry and investigation staff joined the OPC and received training, and the OPC now has investigators specialized in IT;
• completed the implementation of the case management system in September 2009, a major milestone in improving the management of information and data;
• put in place an internal audit function, as per the TBS Policy on Internal Audit, with an Audit Committee active since January 2009 and composed of external members (http://www.priv.gc.ca/aboutUs/iac_e.cfm#contenttop). Internal audits of information management practices and the human resources functions were completed in 2009-2010, with final reports to be posted on the OPC website in 2010;
• processed all requests for information received during the reporting period within the legislated timeframe: 52 requests under the Access to Information Act and 61 requests under the Privacy Act.

Lessons learned

With the continued implementation of the 2008-2011 Integrated Business and Human Resources Plan, the OPC took an assertive approach toward recruitment and retention, and the results have been positive. Leaves (without pay or maternity) were filled temporarily by contractors where appropriate, and students were also employed to relieve workload while staffing procedures were underway. As for many organizations the challenge for the OPC is to maintain the momentum in a competitive and changing labour market.

The OPC has experienced significant changes in recent years, including a significant influx of new investigators, a new system to manage its caseload data, outsourcing as a new method of working. The Office will continue to evolve with more change, such as the opening of a new office in Toronto in 2010. As such, the OPC is formalizing a strategy for change management.

The Office will also review its new case management system in 2010-2011, to ensure the system meets OPC information.

The internal audit function, in existence since January 2009, is driving valuable improvements to OPC management practices. However, the number of audit projects that can be performed in a fiscal year may need to be reduced, given the investment of time and resources that the first few audits required.

Section III: Supplementary Information

This section presents the financial highlights for 2009-2010 and a supplementary information table. Audited financial statements can be found on the OPC website.

3.1 Financial Highlights

Condensed Statement of Financial Position
For the Period ending March 31, 2010

	% Change	2009-2010 ($000)	2008-2009 ($000)
Total Assets	(35%)	3,411	5,259
Total Liabilities	(27%)	5,172	7,110
Total Equity	5%	(1,761)	(1,851)
Total	(35%)	3,411	5,259

Condensed Statement of Operations
For the Period ending March 31, 2010

	% Change	2009-2010 ($000)	2008-2009 ($000)
Total Expenses	(3%)	24,808	25,474
Net Cost of Operations	(3%)	24,808	25,474

Total assets were $3.411M at the end of 2009-2010, a decrease of $1.848M (35 percent) over the previous year's total assets of $5.259M. Of the total assets, $1.709M (50 percent) were to be received from the Consolidated Revenue Fund. Tangible capital assets represented 40 percent of total assets, while accounts receivable and advances made up 7 percent and prepaid expenses, 3 percent of total assets.

Total liabilities were $5.172M at the end of 2009-2010, a decrease of $1.938M (27 percent) over the previous year's total liabilities of $7.110M. Employee severance benefits represented the largest portion of liabilities, at $2.683M, or 52 percent of the total. Accounts payable and accrued liabilities represented a slightly smaller portion of the total liabilities, at $1.727M, or 34 percent. Vacation/compensation pay and accrued employee salaries accounted for 11 percent and 3 percent of total liabilities, respectively.

Total expenses for the OPC were $24.808M in 2009-2010. The largest share of the funds, $10.539M, or 42 percent, was spent on compliance activities, while research and policy development represented $4.369M, or 18 percent, of total expenses. Public outreach efforts represented $3.517M of the expenditures, or 14 percent of the total. Internal Services accounted for the remainder of the expenditures, at $6.383M, or 26 percent of the total.

Audited Financial Statements

Information on OPC's audited financial statements can be found at the following link: http://www.priv.gc.ca/information/an-av_e.cfm#contenttop

3.2 Supplementary Information Tables

The OPC has a single supplementary table as follows:

Table 10 - Internal Audit and Evaluation

Approved internal audit and evaluation reports are available on the OPC website: http://www.tbs-sct.gc.ca/dpr-rmr/st-ts-eng.asp.

---

¹ Reference is made to "individuals" in accordance with the legislation.

² The TBS scale for performance status refers to the proportion of the expected level of performance (as evidenced by either the planned activities and outputs or the indicator and target from the corresponding year's Report on Plans and Priorities) achieved during the fiscal year. The ratings are: exceeded - more than 100 percent; met all - 100 percent; mostly met - 80 to 99 percent; somewhat met - 60 to 79 percent; and not met - less than 60 percent.

³Type is defined as previous (committed to in one of the past two Reports on Plans and Priorities [RPP]); ongoing (committed to at least three fiscal years prior to this RPP), or new (committed to in this RPP).

⁴This priority, first presented in the 2008-2009 Report on Plans and Priorities with a focus on Canadians only, was broadened in 2009-2010 to also include organizations and institutions.

⁵In future reports, timeliness of responses will be calculated by the proportion of complaints completed within service standards. In 2009-2010, the OPC completed a major review of its processes for handling inquiries and complaints, and new service standards will be set on that basis in 2010-2011. Until then, this report presents the Office's actual treatment time to close complaints. As well, the OPC is developing a new quality-assurance mechanism for its investigation process, which will complement the timeliness indicator when evaluating the effectiveness of OPC responses to individuals' complaints.

⁶The audits completed in 2009-2010 were: Audit of the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC), Nov. 17, 2009; Audit of the Passenger Protect Program of Transport Canada, Nov. 17, 2009; Audit of Federal Annual Privacy Reports, Nov. 17, 2009; Audit of Wireless Technology Within Selected Federal Institutions (not yet published at time of writing this report), and Audit of Selected Mortgage Brokers, published June 8, 2010, after this reporting period.

⁷ At the present time, this indicator measures responsiveness of federal government departments to the OPC advice on their PIAs. In the future, the measure may be broadened to also cover private-sector organizations and other OPC activities.

⁸ The indicator is about the "reach" to "organizations". The target associated with this indicator, as published in the 2009-2010 RPP, is also used to measure the reach to "individuals" (as the target audience). Therefore, the information presented earlier in this table as it relates to "individuals" is also relevant to this indicator for "organizations". In the 2010-2011 RPP, the OPC has made its measure of reach to organizations more specific.

⁹ A research project on social network use in the North had also been approved but was then cancelled due to extenuating circumstances experienced by the contracted researcher.

¹⁰ In light of the OPC's independence from government, one of the 21 MAF criteria does not apply; it relates to government priority horizontal initiatives.