ARCHIVED - RPP 2007-2008
Offices of the Information and Privacy Commissioners of Canada

• Previous Page
• Table of Contents
• Next Page

This page has been archived.

Section I: Overview

1.1 Message of the Privacy Commissioner of Canada

I am pleased to present this 2007-2008 Report on Plans and Priorities, which sets out the strategic directions, priorities, expected results and spending estimates for the Office of the Privacy Commissioner of Canada (OPC) for the coming fiscal year.

Privacy is an important right in and of itself. The right of privacy also serves as the foundation for many other civic, political, social and economic rights, including autonomy, dignity and integrity of the person. Parliament has recognized the importance of privacy by enacting the Privacy Act and the Personal Information Protection and Electronic Documents Act (PIPEDA) and by creating this Office to supervise the application of these laws.

The pressures to diminish informational privacy that were identified in last year's Report on Plans and Priorities remain strongly in evidence — the growing willingness of government to share information in the name of national security, flows of personal information across borders, the pervasive use of technologies such as global positioning systems and radio frequency identification devices (RFIDs), and the potential that publicly available personal information will be used for malevolent purposes. The findings of the recent inquiry into the arrest of Canadian Maher Arar have served to emphasize the seminal role that personal information plays in security matters, and the serious dangers that can arise for individuals when government institutions communicate inaccurate information about them.

On many fronts, the environment will continue to be hostile to privacy in the coming year. Campaigns based on fear of internal or external threats will undoubtedly lead to calls to diminish privacy further in the name of security. Commercial expediency will drive additional privacy intrusions, and information technology will facilitate yet others. However, the OPC is now in a stronger position to assert the privacy rights of Canadians. It is fully devoting the considerable energies and talents of its employees to do just that.

The OPC has identified five strategic priorities for the planning period of this Report on Plans and Priorities to give focus to its activities and move further towards achieving its Strategic Outcome of protecting the privacy rights of individuals. The five priorities are as follows:

• Improve and expand service delivery;
• Engage with Parliament on privacy issues;
• Continue to promote Privacy Act reform and PIPEDA review;
• Organize, host and evaluate the 29^th International Conference of Data Protection and Privacy Commissioners; and
• Build organizational capacity.

We stand on a solid financial footing. The recent dialogue between our Office and Parliament about our funding needs resulted in a substantial increase in funding. We are working to improve and expand service delivery. We are able to focus our resources on protecting and promoting the privacy rights of individuals in the public and private sectors, and preventing risks to personal information.

We continue to strengthen our capacity to assess the privacy impact of federal government initiatives. The tools for this purpose are Privacy Impact Assessments (PIAs) and Preliminary Privacy Impact Assessments (PPIAs), and we work with departments and agencies to ensure their activities and projects are respectful of privacy. Our audit activities will increase in the next year to verify compliance with privacy legislation and to encourage the growth of fair information practices in Canada.

We will continue to promote reform of the Privacy Act and actively participate in the review of PIPEDA, the core legislative vehicles for privacy protection, so as to ensure that legal standards are sufficiently robust to address continually evolving challenges to privacy. We will persist to make our voice heard in Parliament by appearing before committees about the potential privacy implications of other proposed laws and recommend ways of ensuring respect of individuals' privacy rights. We will also meet with our counterparts in federal departments and agencies to comment on the consequences for privacy of their program or policy initiatives. Wherever possible, we will address privacy issues in the private sector through a process of dialogue.

We recognize the need to strengthen our communication of privacy issues to the public, businesses and government, and will continue to increase our efforts to do so in the coming year, often in collaboration with our provincial and territorial counterparts. On another front, we want to better understand the privacy risks that derive from the complex nature of our society. Electronic health records, anti-crime and anti-terrorism surveillance measures, commercial imperatives to use personal information for economic profit, and new, cutting-edge information technologies, all need to be understood in context. Enhancing general understanding has been a key objective of the OPC's Research Contributions Program in the past year, and it will continue to tie into the Office's key strategic objectives in the coming fiscal year. Increasingly, our role will be to suggest a blueprint for the future when dealing with issues as diverse as Privacy Act reform, health information and identity management.

In September 2007 the OPC will host the 29^th International Conference of Data Protection and Privacy Commissioners. This event brings together data protection commissioners and privacy experts from around the world, and offers an opportunity to share ideas about a broad range of privacy issues and transfer knowledge of important research results worldwide. The conference is also an important vehicle for data protection authorities, including this Office, to learn and benefit from the experiences of other such bodies and forge productive collaborations to address global privacy issues. Planning for this conference began in 2006-07, and the OPC will devote considerable energy and resources to organizing and hosting the event in the coming fiscal year.

In closing, the year 2007-2008 promises to be exciting and full of challenges. We are meeting these challenges head-on to fulfil the mandate that was entrusted to us by Parliament and to ultimately better protect the privacy rights of Canadians.

Jennifer Stoddart
Privacy Commissioner of Canada

1.2 Management Representation Statement

I submit for tabling in Parliament, the 2007-2008 Report on Plans and Priorities (RPP) for the Office of the Privacy Commissioner of Canada.

This document has been prepared based on the reporting principles contained in Guide for the Preparation of Part III of the 2007-2008 Estimates: Reports on Plans and Priorities and Departmental Performance Reports:

• It adheres to the specific reporting requirements outlined in the Treasury Board Secretariat (TBS) guidance;
• It is based on the OPC's Strategic Outcome and Program Activity Architecture structure that were approved by the Treasury Board;
• It presents consistent, comprehensive, balanced and reliable information;
• It provides a basis of accountability for the results achieved with the resources and authorities entrusted to it; and
• It reports finances based on approved planned spending numbers from TBS in the RPP.

Jennifer Stoddart
Privacy Commissioner of Canada

1.3 Raison d'Être

The mandate of the OPC is to protect and promote the privacy rights of individuals.

The OPC is responsible for overseeing compliance with both the Privacy Act, which covers the personal information-handling practices of federal government departments and agencies, and the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's private sector privacy law.

The Privacy Commissioner of Canada, Jennifer Stoddart, is an Officer of Parliament who reports directly to the House of Commons and the Senate.

The Commissioner is an advocate for the privacy rights of Canadians and her powers include:

• Investigating complaints, conducting audits and pursuing court action under two federal laws;
• Publicly reporting on the personal information-handling practices of public and private sector organizations;
• Supporting, undertaking and publishing research into privacy issues; and
• Promoting public awareness and understanding of privacy issues.

The Commissioner works independently from any other part of the government to investigate complaints from individuals with respect to the federal public sector and the private sector. In public sector matters, individuals may complain to the Commissioner about any matter specified in Section 29 of the Privacy Act. This Act applies to personal information held by Government of Canada institutions.

For matters relating to personal information in the private sector, the Commissioner may investigate all complaints under Section 11 of PIPEDA except in the provinces that have adopted substantially similar privacy legislation, namely Quebec, British Columbia, and Alberta. Ontario also falls into this category with respect to personal health information held by health information custodians under its health sector privacy law. However, even in those provinces with substantially similar legislation, and elsewhere in Canada, PIPEDA continues to apply to personal information collected, used or disclosed by all federal works, undertakings and businesses, including personal information about their employees. Also, PIPEDA applies to all personal data that flows across provincial or national borders, in the course of commercial transactions involving organizations subject to the Act or to substantially similar legislation.

We focus on resolving complaints through negotiation and persuasion, using mediation and conciliation if appropriate. However, if voluntary co-operation is not forthcoming, the Commissioner has the power to summon witnesses, administer oaths and compel the production of evidence. In cases that remain unresolved, particularly under PIPEDA, the Commissioner may take the matter to Federal Court and seek a court order to rectify the situation.

As a public advocate for the privacy rights of Canadians, the Commissioner carries out the following activities:

• Investigating complaints and issuing reports with recommendations to federal government institutions and private sector organizations to remedy situations, as appropriate;
• Pursuing legal action before the Federal Court where matters remain unresolved;
• Assessing compliance with obligations contained in the Privacy Act and PIPEDA through the conduct of independent audit and review activities, and publicly reporting on findings;
• Advising on, and reviewing privacy impact assessments (PIAs) of new and existing government initiatives;
• Providing legal and policy analyses and expertise to help guide Parliament's review of evolving legislation to ensure respect for individuals' right to privacy;
• Responding to inquiries of Parliamentarians, individual Canadians and organizations seeking information and guidance and taking proactive steps to inform them of emerging privacy issues;
• Promoting public awareness and compliance, and fostering understanding of privacy rights and obligations through: proactive engagement with federal government institutions, industry associations, legal community, academia, professional associations, and other stakeholders; preparation and dissemination of public education materials, positions on evolving legislation, regulations and policies, guidance documents and research findings for use by the general public, federal government institutions and private sector organizations;
• Providing legal opinions and litigating court cases to advance the interpretation and application of federal privacy laws;
• Monitoring trends in privacy practices, identifying systemic privacy issues that need to be addressed by federal government institutions and private sector organizations and promoting integration of best practices; and
• Working with privacy stakeholders from other jurisdictions in Canada and on the international scene to address global privacy issues that result from ever-increasing trans-border data flows.

1.4 Values

The OPC is committed to the values and ethics in the workplace and senior managers agree, as part of their performance management agreements, to:

• Lead a representative workplace in which every employee feels valued, respected, informed, involved and engaged in their work; and
• Effectively manage financial resources within delegated authorities in accordance with the principles of modern comptrollership.

In addition, the OPC is committed to the principles of Employment Equity and achieving equality in the workplace. Our Employment Equity program aims to ensure that all designated groups are fully represented. Members of the Senior Management Committee meet annually to discuss their accountability for the Employment Equity Plan and the achievement of employment equity goals and objectives.

1.5 Roles and Expected Results

Pursuing its Institutional Vision presented in the 2006-2007 Report on Plans and Priorities of serving four client groups, the OPC has four complementary roles (see Figure 1 below):

• Parliamentarians: Proactively supporting Parliament's needs
• Individuals: Effectively processing complaints and increasing public literacy in privacy
• Federal Government institutions¹: Supporting the federal government's efforts to improve its privacy management framework
• Private Sector organizations: Proactively promoting and enabling compliance

Figure 1: OPC Vision

In 2006-2007, the OPC made significant progress to articulate the outcomes that Parliamentarians and Canadians may expect to benefit from its activities: the Results Framework shown in Figure 2 below reflects the contribution that the OPC has on the protection of individuals' privacy rights in the long, medium and short term.

Figure 2: OPC Results Framework

Strategic Outcome	The privacy rights of individuals are protected.
Ultimate Outcome	The Office of the Privacy Commissioner plays a lead role in influencing federal government institutions and private sector organizations to respect the privacy rights of individuals and protect their personal information.
	Program Activity 1: Compliance activities	Program Activity 2: Research and policy development	Program Activity 3: Public outreach
Intermediate Outcomes	Individuals receive effective responses to their inquiries and complaints. Federal government institutions and private sector organizations meet their obligations under federal privacy legislation and implement modern principles of personal information protection.	Parliamentarians and others have access to clear, relevant information, and timely and objective advice about the privacy implications of evolving legislation, regulations and policies.	Individuals have relevant information about privacy rights and are enabled to guard against threats to their personal information. Federal government institutions and private sector organizations understand their obligations under federal privacy legislation.
Immediate Outcomes	The process to respond to inquiries and investigate complaints is effective and efficient. The process to conduct audits and reviews is effective and efficient, including effective review of privacy impact assessments (PIAs) for new and existing government initiatives.	The work of Parliamentarians is supported by an effective capacity to identify and research privacy issues, and to develop policy positions for the federal public and private sectors, which are respectful of privacy. Knowledge about systemic privacy issues in Canada is enhanced, serves to advance the interpretation and application of federal privacy laws, and improves privacy management practices.	Individuals receive and have easy access to relevant information about privacy and personal data protection, enabling them to better protect themselves and exercise their rights. Federal government institutions and private sector organizations receive useful guidance on privacy rights and obligations, contributing to better understanding and enhanced compliance.
The Management Component enables the OPC to deliver its privacy business	The Office of the Privacy Commissioner achieves a standard of organizational excellence, and managers and staff apply sound business management practices. Key elements of the OPC Management Accountability Framework are integrated into management practices and influence decision-making at all levels. The OPC has a productive, principled, sustainable and adaptable workforce that achieves results in a fair, healthy and enabling workplace. HR management practices reflect new accountabilities stemming from Public Service Modernization Act (PSMA) and Public Service Employment Act (PSEA). Managers and staff demonstrate exemplary professional and ethical conduct in all of their work, and are responsive to the highly visible and complex nature of the environment in which they operate. The performance of the OPC is defined, measured and reported upon regularly in a meaningful and transparent manner.

1.6 Financial and Human Resources

The following two tables present the financial and human resources of the OPC over the next three fiscal years.

Financial Resources (planned)

2007-2008	2008-2009	2009-2010
$19,711,000	$18,919,000	$18,937,000

Human Resources (planned)

2007-2008	2008-2009	2009-2010
154 FTEs*	150 FTEs*	150 FTEs*

* FTE: Full-time equivalent

The planned increase in financial and human resources in 2007-2008 is due to the phasing in of the resource levels as described in the business case presented to the House of Commons Advisory Panel on the Funding of Officers of Parliament. The resource levels peak in 2007-2008 due to the initial set up costs for new employees and temporary resources to address the backlog of privacy investigations. The resource levels for 2008-2009 represent the ongoing requirements for future years.

The planned spending numbers for 2007-2008 through 2009-2010 include resources that will be required for new responsibilities related to the implementation of the Federal Accountability Act (FedAA); namely the creation of an office to manage access to information and privacy requests and additional privacy investigators to handle new organizations that are now subject to the Privacy Act. Funds for the implementation of the FedAA within the OPC have been earmarked within the Government of Canada fiscal framework. However, final spending plans will only be determined once a detailed business case has been prepared and submitted to the House of Commons Advisory Panel on the Funding of Officers of Parliament and subsequently approved by Treasury Board ministers.

 

• Previous Page
• Table of Contents
• Next Page