Treasury Board of Canada Secretariat
Symbol of the Government of Canada

ARCHIVED - RPP 2007-2008
Offices of the Information and Privacy Commissioners of Canada

Warning This page has been archived.

Archived Content

Information identified as archived on the Web is for reference, research or recordkeeping purposes. It has not been altered or updated after the date of archiving. Web pages that are archived on the Web are not subject to the Government of Canada Web Standards. As per the Communications Policy of the Government of Canada, you can request alternate formats on the "Contact Us" page.




Office of the Information Commissioner of Canada

Office of the Privacy Commissioner of Canada

 




Office of the Information Commissioner of Canada

Office of the Privacy Commissioner of Canada

 





The Honourable Robert Douglas Nicholson, PC, MP
Minister of Justice and Attorney General of Canada


SECTION I: OVERVIEW

SECTION II: ANALYSIS OF PROGRAM ACTIVITIES BY STRATEGIC OUTCOME

SECTION III: SUPPLEMENTARY INFORMATION

SECTION IV: OTHER ITEMS OF INTEREST

 




SECTION I: OVERVIEW

Message from the Information Commissioner of Canada

On September 30, 2006, the Honourable John M. Reid’s term as Information Commissioner of Canada ended. After approval by the House of Commons and Senate, Robert Marleau was appointed as Information Commissioner of Canada effective January 15, 2007. Thus, this report is one of the first official acts of the commissioner but represents a new commissioner’s informed understanding of his office’s statutory mandate, activities and challenges.

By law the commissioner is committed to delivering thorough, fair and timely investigations of complaints made against government under the Access to Information Act (the Act). As well, he is committed to providing complainants, government institutions and Parliament with full reports of the result of investigations and responsible recommendations concerning remedial actions to solve individual complaints and system-wide challenges. Finally, the commissioner is committed to providing professional legal representation before the courts in cases where he considers that refusals by government institutions to disclose requested records are not justified by the Act.

These activities, along with the corporate services necessary to support them, constitute the business lines of the Office of the Information Commissioner.

The office, in addition to its legally mandated business lines, faces a number of challenges which constitute elements of its plans and priorities. They include:

  1. Assisting the government and Parliament in considering proposals for reform of the Act as announced in the government’s action plan on access reform.

  2. Establishing and administering, for the first time within the office, a capacity to respond to requests made under the Act and the Privacy Act and, generally, to comply with the administrative provisions of those statutes.

  3. Proceeding with the office’s plan to reduce its backlog of investigations and ensure that appropriate service standards are met with respect to an expected increase in complaints resulting from passage of the Federal Accountability Act.

  4. Establishing, for the first time, an internal audit capacity within the office and, in concert with other officers of Parliament, ensuring that mechanisms of accountability are in place which are effective but do not compromise the commissioner’s independence from government.

It is an honour and privilege for this new commissioner to take on this mandate and to strive, by discharging it with diligence, integrity, professionalism and fairness, to facilitate our democracy.

                                                                                         
Robert Marleau
Information Commissioner of Canada

Management Representation Statement

I submit for tabling in Parliament, the 2007-2008 Report on Plans and Priorities (RPP) for the Office of the Information Commissioner of Canada.

This document has been prepared based on the reporting principles contained in the Guide for the preparation of Part III of the 2007-2008 Estimates: Reports on Plans and Priorities:

  • It adheres to the specific reporting requirements outlined in the Treasury Board Secretariat guidance;

  • It is based on the Office of the Information Commissioner of Canada’s Strategic Outcome and Program Activity Architecture that were approved by the Treasury Board;

  • It presents consistent, comprehensive, balanced and reliable information;

  • It provides a basis of accountability for the results achieved with the resources and authorities entrusted to it; and

  • It reports finances based on approved planned spending numbers from the Treasury Board Secretariat.

                                                                                         
J. Alan Leadbeater
Deputy Information Commissioner of Canada

Summary Information

The Access to Information Act, adopted by the Parliament of Canada in 1983, provides for the right of Canadian citizens, whether or not they reside in Canada, along with all individuals present in Canada to request and gain access to any record under the control of a federal institution subject to limited and specific exceptions. The Office of the Information Commissioner is established to receive and investigate complaints from persons who believe that government institutions have not respected the rights given to them by the Act.


Financial Resources ($ thousands)

2007-2008

2008-2009

2009-2010

9 248

8 930

8 185




Human Resources

2007-2008

2008-2009

2009-2010

90

90

82




Program Activities by Strategic Outcome

Planned Spending

2007-2008

2008-2009

2009-2010

Strategic Outcome: Individuals’ rights under the Access to Information Act are safeguarded

Program Activity:

Assess, investigate, review, pursue judicial enforcement, and provide advice.

9 248

8 930

8 185


Priorities

As described in the overview message, the Access to Information Act sets out three ongoing priorities that the office must address to fulfil this strategic outcome.

In addition to undertaking these priority activities, the Office of the Information Commissioner will strive to reduce the number of access to information complaints. The office will work to achieve this objective in three ways: by engaging in reviews and or systemic investigations of government departments; by encouraging departmental personnel that deal with access to information requests to upgrade their skills and knowledge; and by educating managers in federal government institutions on their responsibilities and obligations under the Access to Information Act.

As well, the Office of the Information Commissioner will assist the government and Parliament in assessing the implications of draft legislation on the right of access and in assessing proposals for reform of the Act.

 




SECTION II: ANALYSIS OF PROGRAM ACTIVITIES BY STRATEGIC OUTCOME

Analysis by Program Activity

Strategic Outcome

Individuals’ rights under the Access to Information Act are safeguarded.

Program Activity

Assess, investigate, review, pursue judicial enforcement, and provide advice.

Performance Indicators

Investigations:

  1. percentage of complaint investigations completed within set service standards;

  2. percentage of well-founded complaints resolved without recourse to courts;

  3. percentage of cases where courts have come to a conclusion different from the commissioner after review under section 41 of the Act;

  4. percentage of cases successfully challenged pursuant to section 18 of the Federal Court Act.

Reporting:

  1. meeting deadlines for statutory reports, i.e. Annual Report to Parliament

  2. meeting the reporting requirement in section 37 of the Act

  3. percentage of well-founded complaints resolved without recourse to courts

Advocacy before the Courts:

  1. demonstrated consistency in selection criteria for seeking judicial review; and

  2. percentage of successful outcomes

Backlog

A backlogged complaint is one that remains open beyond the fixed deadlines established by the office. These deadlines are set down in the office’s Service Standards, which cover all aspects of an investigation—from receipt of the complaint to the conclusion of the formal investigation process. Current Service Standards allot 30 calendar days for the resolution of administrative related complaints, such as complaints related to delay and fees, and 90 calendar days for refusal related complaints, such as exemptions, exclusions and incomplete responses.

For several years, the workload of incoming complaints has outstripped the office’s ability to conduct investigations in a timely manner. As of January 23, 2007, the backlog of outstanding files sits at 1 075. The nature of the workload has also changed, with a larger proportion of incoming complaints necessitating extensive research and in-depth consultation with government officials.

The office closed 999 outstanding investigations as of January 23, 2007, and projects to close an additional 201 complaints by the end of the 2006-2007 fiscal-year. The office will accelerate its backlog in the 2007-2008 fiscal year. Given the additional financial resources and workload projections for the coming year, the office anticipates clearing this backlog by the end of the 2008-2009 fiscal year.

Complaints

The number of complaints received annually by the office is influenced largely by two factors: the extent of public awareness that information is accessible pursuant to the Access to Information Act, and the level of performance by government institutions in responding promptly and fully to access to information requests.

The table below shows figures related to the status of access to information complaints received by the office during the last two fiscal-years and the coming fiscal-year.

Status of Access-to-information Complaints


 

2005-2006

2006-2007
(projected)

2007-2008
(projected)

Pending

1 364

1 418

1 286

Opened

1 373

1 068

1 200

Closed

1 319

1 200

1 170 to 1 620

Under investigation

1 418

1 286

866 to 1 316


Enhancing investigator training

To ensure that the Office of the Information Commissioner continues to enjoy the services of a cadre of skilled investigators, the office will continue to place priority on providing an extensive training program for new investigators and a program of continuing education for experienced ones.

In addition to the enhanced training program, in the 2006-2007 fiscal-year, the office began its Investigator Career Progression Program, as defined under the Public Service Employment Act. Using a series of training sessions, examinations and special assignments, the program will enable investigators to raise their designation one level every 12 to 18 months. The primary objective of the program is to provide a career path for investigators based on learning, knowledge, and experience.

A record of achievement

A clear indication of the professionalism and effectiveness of investigators is that less than one percent of all access to information complaints reached the Federal Court of Canada last year. This record is in keeping with the long-term performance of the office. From April 1, 2000 to March 31, 2006:

  • 48 complainants filed judicial reviews under section 41 of the Access to Information Act;

  • the Information Commissioner initiated 16 judicial reviews pursuant to section 42 of the Access to Information Act;

  • 132 third parties undertook reviews of government institutions’ decisions to disclose third-party information provided for by section 44 of the Access to Information Act;

  • the Office of the Information Commissioner participated in 17 appeals before the Federal Court of Canada and 11 appeals before the Supreme Court of Canada.

This record also reflects the positive and proactive role the office has played over the years to help improve case-management practices of the Federal Court of Canada and reduce the backlog of access to information cases before the courts. The additional financial resources allotted to the office in 2007-2008 will enable it to increase this proactive role. For instance, increased funding will enable the office to intervene and assist the Federal Court of Canada to interpret and apply the Access to Information Act. The lack of sufficient financial resources available to the office in recent years had jeopardized the vital role the office must play before the judiciary.

The value of report cards

The Office of the Information Commissioner uses annual report card reviews to inform federal institutions of the state of their performance in satisfying the requirements of the Access to Information Act. Report cards also enable the office to monitor specific federal institutions with poor performance records and to make recommendations for improvement.

In the last fiscal-year, report cards were issued to 17 federal institutions. These institutions were selected for a number of reasons: one routinely experienced difficulty meeting response deadlines set out in the Access to Information Act; two had failing grades in each of the past three years, and 14 institutions were graded to evaluate recent efforts to raise performance. These institutions who do not attain ideal compliance "Grade A" will again be reviewed in 2007-2008.

Improving professional skills, raising professional standards

One of the best ways to improve the performance of federal institutions in satisfying the requirements of the Access to Information Act is to ensure information professionals throughout the federal government possess a high level of skill and knowledge. To improve the skills and knowledge of these professionals, the Office of the Information Commissioner has partnered with the University of Alberta to create the Certificate Program in Information Access and the Protection of Privacy. Offered online in French and English, the program consists of 6 courses requiring five for the Certificate.

In order to help raise the standards of the access to information community, the OIC has given its support to two of the professional organizations of access and privacy workers – the Canadian Access and Privacy Association (CAPA) and the Canadian Association of Professional Access and Privacy Administrators (CAPAPA) – which have undertaken a major project to professionalize the access and privacy community. This project is developing professional standards for workers in this field, establishing a certification model and process and preparing a governance structure for the profession. The project is guided by a Working Group which is comprised of leading experts in the fields of access to information and the protection of privacy and is headed by the Alberta Access and Privacy Commissioner. The OIC has seconded an employee from the Government of Alberta to act as the National Director of this project.

 




SECTION III: SUPPLEMENTARY INFORMATION

Organizational Information

Links to the Government of Canada Outcome areas


($ thousands)

2007-2008

Strategic Outcome: Individual’s rights under the Access to Information Act are safeguarded.

Operating

Total Main Estimates

Adjustments
(planned spending not in Main Estimates)

Total Planned Spending

Program Activity:

Assess, investigate, review, pursue judicial enforcement, and provide advice

7 660

7 660

1 588

9 248

Total Resources

7 660

7 660

1 588

9 248


Table 1: Planned Spending and Full-time Equivalents


($ thousands)

Forecast Spending

PLANNED SPENDING

Program Activity:

2006-2007

2007-2008

2008-2009

2009-2010

Assess, investigate, review, pursue judicial enforcement, and provide advice

8 181

7 660

7 660

6 912

Total Main Estimates

8 181

7 660

7 660

6 912

Adjustments:

Supplementary Estimates

  Operating budget carry forward

43

  Collective Agreements

54

6

6

6

Other

  Federal Accountability Action Plan

1 582

1 264

1 267

  Year End Lapse *

(703)

Total Adjustments

(606)

1 588

1 270

1 273

Total Planned Spending

7 575

9 248

8 930

8 185

  Plus:
  Cost of services received without charge

824

1 007

1 098

1 060

Total

8 399

10 255

10 028

9 245

Full-time Equivalents

57

90

90

82


* The forecasted lapse is due to an accommodation shortage resulting in staffing delays primarily related to the Special Purpose Allotment entitled "Accumulated Backlog – Complaints Investigations" and the additional FTEs and related items recommended by the House of Commons Advisory Panel and approved by the Treasury Board.

The decrease in total planned spending in 2009-2010 is related to the temporary resources to eliminate the backlog in Investigations and Reviews received to the end of 2008-2009 only.

Table 2: Voted and Statutory Items


Vote or Statutory Item

Truncated Vote or Statutory Wording

Main Estimates
($ thousands)

2007-2008

2006-2007

40

(S)

Program expenditures

Contributions to employee benefits plans

6 684

976

7 188

993

 

Total Expenditure

7 660

8 181


The primary difference between the 2006-2007 and 2007-2008 Main Estimates is the one-time funding received in 2006-2007 for Office and Information Technology Set-up Costs.

Table 3: Services Received Without Charge


($ thousands)

2007-2008

Accommodation provided by Public Works and Government Services Canada (PWGSC)

498

 

Contributions covering employers' share of employees' insurance premiums and expenditures paid by Treasury Board Secretariat

431

 

Office of the Auditor General of Canada – Audit Services

78

Total 2007-2008 Services received without Charge

1 007


 




SECTION IV: OTHER ITEMS OF INTEREST

Impact of the Federal Accountability Act

On December 12, 2006, the Parliament of Canada adopted Bill C-2, the Federal Accountability Act. The legislation amends several existing laws and proposes two new acts related to political accountability.

One of the statutes affected by passage of Bill C-2 is the Access to Information Act. The new law amends the Access to Information Act to extend its application to 15 institutions including Officers of Parliament, Crown corporations and foundations. Amendments also establish new exemptions or exclusions related to the 15 added entities.

By expanding application of the Access to Information Act, the Federal Accountability Act affects the Office of the Information Commissioner in two ways. First, the Office of the Information Commissioner must hire additional investigators and legal staff to prepare for an increased number of complaints that will result from new institutions being subject to the Access to Information Act. A short-term increase in workload is expected to occur due to pent-up demand for information from these institutions. Overall workload is expected to remain above current levels once this pent-up demand is released.

Second, the Federal Accountability Act will make the Office of the Information Commissioner subject to both the Privacy Act and the Access to Information Act. To comply with these laws, the Office of the Information Commissioner must create and fill new positions, including a director of information services and knowledge management, and various professional, clerical and administrative staff. In addition, new software and hardware will be needed to process access to information requests.

The Office of the Information Commissioner completed a business case and implementation plan to manage these changes and hired an interim director of information services and knowledge management through secondment in October 2006. However, specific funding and resource requirements will not be known until the Office of the Information Commissioner has analyzed the final wording of the Federal Accountability Act and coming-into-force dates for the new entities covered by the law. As a result, planned expenditures for 2007-2008 and 2008-2009 do not cover any specific spending commitments to manage implementation of the Federal Accountability Act.

 






The Honourable Robert D. Nicholson, P.C., Q.C., M.P.
Minister of Justice and Attorney General of Canada


Section I: Overview

1.1 Message of the Privacy Commissioner of Canada
1.2 Management Representation Statement
1.3 Raison d'Être
1.4 Values
1.5 Roles and Expected Results
1.6 Financial and Human Resources

Section II: Plans and Priorities

2.1 Factors Influencing Privacy and the OPC
2.2 Summary of OPC Plans and Priorities for 2007-2008
2.3 Link Between Priorities, Expected Results and Program Activities
2.4 Analysis by Program Activity

Section III: Supplementary Information

3.1 Organizational Information
3.2 Resource Tables
3.3 Sources of Additional Information

 




Section I: Overview

1.1 Message of the Privacy Commissioner of Canada

Photo : Jennifer StoddartI am pleased to present this 2007-2008 Report on Plans and Priorities, which sets out the strategic directions, priorities, expected results and spending estimates for the Office of the Privacy Commissioner of Canada (OPC) for the coming fiscal year.

Privacy is an important right in and of itself. The right of privacy also serves as the foundation for many other civic, political, social and economic rights, including autonomy, dignity and integrity of the person. Parliament has recognized the importance of privacy by enacting the Privacy Act and the Personal Information Protection and Electronic Documents Act (PIPEDA) and by creating this Office to supervise the application of these laws.

The pressures to diminish informational privacy that were identified in last year's Report on Plans and Priorities remain strongly in evidence — the growing willingness of government to share information in the name of national security, flows of personal information across borders, the pervasive use of technologies such as global positioning systems and radio frequency identification devices (RFIDs), and the potential that publicly available personal information will be used for malevolent purposes. The findings of the recent inquiry into the arrest of Canadian Maher Arar have served to emphasize the seminal role that personal information plays in security matters, and the serious dangers that can arise for individuals when government institutions communicate inaccurate information about them.

On many fronts, the environment will continue to be hostile to privacy in the coming year. Campaigns based on fear of internal or external threats will undoubtedly lead to calls to diminish privacy further in the name of security. Commercial expediency will drive additional privacy intrusions, and information technology will facilitate yet others. However, the OPC is now in a stronger position to assert the privacy rights of Canadians. It is fully devoting the considerable energies and talents of its employees to do just that.

The OPC has identified five strategic priorities for the planning period of this Report on Plans and Priorities to give focus to its activities and move further towards achieving its Strategic Outcome of protecting the privacy rights of individuals. The five priorities are as follows:

  • Improve and expand service delivery;
  • Engage with Parliament on privacy issues;
  • Continue to promote Privacy Act reform and PIPEDA review;
  • Organize, host and evaluate the 29th International Conference of Data Protection and Privacy Commissioners; and
  • Build organizational capacity.

We stand on a solid financial footing. The recent dialogue between our Office and Parliament about our funding needs resulted in a substantial increase in funding. We are working to improve and expand service delivery. We are able to focus our resources on protecting and promoting the privacy rights of individuals in the public and private sectors, and preventing risks to personal information.

We continue to strengthen our capacity to assess the privacy impact of federal government initiatives. The tools for this purpose are Privacy Impact Assessments (PIAs) and Preliminary Privacy Impact Assessments (PPIAs), and we work with departments and agencies to ensure their activities and projects are respectful of privacy. Our audit activities will increase in the next year to verify compliance with privacy legislation and to encourage the growth of fair information practices in Canada.

We will continue to promote reform of the Privacy Act and actively participate in the review of PIPEDA, the core legislative vehicles for privacy protection, so as to ensure that legal standards are sufficiently robust to address continually evolving challenges to privacy. We will persist to make our voice heard in Parliament by appearing before committees about the potential privacy implications of other proposed laws and recommend ways of ensuring respect of individuals' privacy rights. We will also meet with our counterparts in federal departments and agencies to comment on the consequences for privacy of their program or policy initiatives. Wherever possible, we will address privacy issues in the private sector through a process of dialogue.

We recognize the need to strengthen our communication of privacy issues to the public, businesses and government, and will continue to increase our efforts to do so in the coming year, often in collaboration with our provincial and territorial counterparts. On another front, we want to better understand the privacy risks that derive from the complex nature of our society. Electronic health records, anti-crime and anti-terrorism surveillance measures, commercial imperatives to use personal information for economic profit, and new, cutting-edge information technologies, all need to be understood in context. Enhancing general understanding has been a key objective of the OPC's Research Contributions Program in the past year, and it will continue to tie into the Office's key strategic objectives in the coming fiscal year. Increasingly, our role will be to suggest a blueprint for the future when dealing with issues as diverse as Privacy Act reform, health information and identity management.

In September 2007 the OPC will host the 29th International Conference of Data Protection and Privacy Commissioners. This event brings together data protection commissioners and privacy experts from around the world, and offers an opportunity to share ideas about a broad range of privacy issues and transfer knowledge of important research results worldwide. The conference is also an important vehicle for data protection authorities, including this Office, to learn and benefit from the experiences of other such bodies and forge productive collaborations to address global privacy issues. Planning for this conference began in 2006-07, and the OPC will devote considerable energy and resources to organizing and hosting the event in the coming fiscal year.

In closing, the year 2007-2008 promises to be exciting and full of challenges. We are meeting these challenges head-on to fulfil the mandate that was entrusted to us by Parliament and to ultimately better protect the privacy rights of Canadians.

Jennifer Stoddart
Privacy Commissioner of Canada

1.2 Management Representation Statement

I submit for tabling in Parliament, the 2007-2008 Report on Plans and Priorities (RPP) for the Office of the Privacy Commissioner of Canada.

This document has been prepared based on the reporting principles contained in Guide for the Preparation of Part III of the 2007-2008 Estimates: Reports on Plans and Priorities and Departmental Performance Reports:

  • It adheres to the specific reporting requirements outlined in the Treasury Board Secretariat (TBS) guidance;
  • It is based on the OPC's Strategic Outcome and Program Activity Architecture structure that were approved by the Treasury Board;
  • It presents consistent, comprehensive, balanced and reliable information;
  • It provides a basis of accountability for the results achieved with the resources and authorities entrusted to it; and
  • It reports finances based on approved planned spending numbers from TBS in the RPP.

Jennifer Stoddart
Privacy Commissioner of Canada

1.3 Raison d'Être

The mandate of the OPC is to protect and promote the privacy rights of individuals.

The OPC is responsible for overseeing compliance with both the Privacy Act, which covers the personal information-handling practices of federal government departments and agencies, and the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's private sector privacy law.

The Privacy Commissioner of Canada, Jennifer Stoddart, is an Officer of Parliament who reports directly to the House of Commons and the Senate.

The Commissioner is an advocate for the privacy rights of Canadians and her powers include:

  • Investigating complaints, conducting audits and pursuing court action under two federal laws;
  • Publicly reporting on the personal information-handling practices of public and private sector organizations;
  • Supporting, undertaking and publishing research into privacy issues; and
  • Promoting public awareness and understanding of privacy issues.

The Commissioner works independently from any other part of the government to investigate complaints from individuals with respect to the federal public sector and the private sector. In public sector matters, individuals may complain to the Commissioner about any matter specified in Section 29 of the Privacy Act. This Act applies to personal information held by Government of Canada institutions.

For matters relating to personal information in the private sector, the Commissioner may investigate all complaints under Section 11 of PIPEDA except in the provinces that have adopted substantially similar privacy legislation, namely Quebec, British Columbia, and Alberta. Ontario also falls into this category with respect to personal health information held by health information custodians under its health sector privacy law. However, even in those provinces with substantially similar legislation, and elsewhere in Canada, PIPEDA continues to apply to personal information collected, used or disclosed by all federal works, undertakings and businesses, including personal information about their employees. Also, PIPEDA applies to all personal data that flows across provincial or national borders, in the course of commercial transactions involving organizations subject to the Act or to substantially similar legislation.

We focus on resolving complaints through negotiation and persuasion, using mediation and conciliation if appropriate. However, if voluntary co-operation is not forthcoming, the Commissioner has the power to summon witnesses, administer oaths and compel the production of evidence. In cases that remain unresolved, particularly under PIPEDA, the Commissioner may take the matter to Federal Court and seek a court order to rectify the situation.

As a public advocate for the privacy rights of Canadians, the Commissioner carries out the following activities:

  • Investigating complaints and issuing reports with recommendations to federal government institutions and private sector organizations to remedy situations, as appropriate;
  • Pursuing legal action before the Federal Court where matters remain unresolved;
  • Assessing compliance with obligations contained in the Privacy Act and PIPEDA through the conduct of independent audit and review activities, and publicly reporting on findings;
  • Advising on, and reviewing privacy impact assessments (PIAs) of new and existing government initiatives;
  • Providing legal and policy analyses and expertise to help guide Parliament's review of evolving legislation to ensure respect for individuals' right to privacy;
  • Responding to inquiries of Parliamentarians, individual Canadians and organizations seeking information and guidance and taking proactive steps to inform them of emerging privacy issues;
  • Promoting public awareness and compliance, and fostering understanding of privacy rights and obligations through: proactive engagement with federal government institutions, industry associations, legal community, academia, professional associations, and other stakeholders; preparation and dissemination of public education materials, positions on evolving legislation, regulations and policies, guidance documents and research findings for use by the general public, federal government institutions and private sector organizations;
  • Providing legal opinions and litigating court cases to advance the interpretation and application of federal privacy laws;
  • Monitoring trends in privacy practices, identifying systemic privacy issues that need to be addressed by federal government institutions and private sector organizations and promoting integration of best practices; and
  • Working with privacy stakeholders from other jurisdictions in Canada and on the international scene to address global privacy issues that result from ever-increasing trans-border data flows.

1.4 Values

The OPC is committed to the values and ethics in the workplace and senior managers agree, as part of their performance management agreements, to:

  • Lead a representative workplace in which every employee feels valued, respected, informed, involved and engaged in their work; and
  • Effectively manage financial resources within delegated authorities in accordance with the principles of modern comptrollership.

In addition, the OPC is committed to the principles of Employment Equity and achieving equality in the workplace. Our Employment Equity program aims to ensure that all designated groups are fully represented. Members of the Senior Management Committee meet annually to discuss their accountability for the Employment Equity Plan and the achievement of employment equity goals and objectives.

1.5 Roles and Expected Results

Pursuing its Institutional Vision presented in the 2006-2007 Report on Plans and Priorities of serving four client groups, the OPC has four complementary roles (see Figure 1 below):

  • Parliamentarians: Proactively supporting Parliament's needs
  • Individuals: Effectively processing complaints and increasing public literacy in privacy
  • Federal Government institutions1: Supporting the federal government's efforts to improve its privacy management framework
  • Private Sector organizations: Proactively promoting and enabling compliance

Figure 1: OPC Vision

In 2006-2007, the OPC made significant progress to articulate the outcomes that Parliamentarians and Canadians may expect to benefit from its activities: the Results Framework shown in Figure 2 below reflects the contribution that the OPC has on the protection of individuals' privacy rights in the long, medium and short term.

Figure 2: OPC Results Framework


Strategic Outcome The privacy rights of individuals are protected.
Ultimate Outcome The Office of the Privacy Commissioner plays a lead role in influencing federal government institutions and
private sector organizations to respect the privacy rights of individuals and protect their personal information.
  Program Activity 1:
Compliance activities
Program Activity 2:
Research and policy development
Program Activity 3:
Public outreach
Intermediate Outcomes

Individuals receive effective responses to their inquiries and complaints.

Federal government institutions and private sector organizations meet their obligations under federal privacy legislation and implement modern principles of personal information protection.

Parliamentarians and others have access to clear, relevant information, and timely and objective advice about the privacy implications of evolving legislation, regulations and policies.

Individuals have relevant information about privacy rights and are enabled to guard against threats to their personal information.

Federal government institutions and private sector organizations understand their obligations under federal privacy legislation.

 

Immediate Outcomes

The process to respond to inquiries and investigate complaints is effective and efficient.

The process to conduct audits and reviews is effective and efficient, including effective review of privacy impact assessments (PIAs) for new and existing government initiatives.

The work of Parliamentarians is supported by an effective capacity to identify and research privacy issues, and to develop policy positions for the federal public and private sectors, which are respectful of privacy.

Knowledge about systemic privacy issues in Canada is enhanced, serves to advance the interpretation and application of federal privacy laws, and improves privacy management practices.

Individuals receive and have easy access to relevant information about privacy and personal data protection, enabling them to better protect themselves and exercise their rights.

Federal government institutions and private sector organizations receive useful guidance on privacy rights and obligations, contributing to better understanding and enhanced compliance.

 

The Management Component enables the OPC to deliver its privacy business The Office of the Privacy Commissioner achieves a standard of organizational excellence, and managers and staff apply sound business management practices.
  • Key elements of the OPC Management Accountability Framework are integrated into management practices and influence decision-making at all levels.
  • The OPC has a productive, principled, sustainable and adaptable workforce that achieves results in a fair, healthy and enabling workplace.
  • HR management practices reflect new accountabilities stemming from Public Service Modernization Act (PSMA) and Public Service Employment Act (PSEA).
  • Managers and staff demonstrate exemplary professional and ethical conduct in all of their work, and are responsive to the highly visible and complex nature of the environment in which they operate.
  • The performance of the OPC is defined, measured and reported upon regularly in a meaningful and transparent manner.

1.6 Financial and Human Resources

The following two tables present the financial and human resources of the OPC over the next three fiscal years.

Financial Resources (planned)


2007-2008 2008-2009 2009-2010
$19,711,000 $18,919,000 $18,937,000

Human Resources (planned)


2007-2008 2008-2009 2009-2010
154 FTEs* 150 FTEs* 150 FTEs*

* FTE: Full-time equivalent

The planned increase in financial and human resources in 2007-2008 is due to the phasing in of the resource levels as described in the business case presented to the House of Commons Advisory Panel on the Funding of Officers of Parliament. The resource levels peak in 2007-2008 due to the initial set up costs for new employees and temporary resources to address the backlog of privacy investigations. The resource levels for 2008-2009 represent the ongoing requirements for future years.

The planned spending numbers for 2007-2008 through 2009-2010 include resources that will be required for new responsibilities related to the implementation of the Federal Accountability Act (FedAA); namely the creation of an office to manage access to information and privacy requests and additional privacy investigators to handle new organizations that are now subject to the Privacy Act. Funds for the implementation of the FedAA within the OPC have been earmarked within the Government of Canada fiscal framework. However, final spending plans will only be determined once a detailed business case has been prepared and submitted to the House of Commons Advisory Panel on the Funding of Officers of Parliament and subsequently approved by Treasury Board ministers.

 




Section II: Plans and Priorities

2.1 Factors Influencing Privacy and the OPC

Operating Environment

This section describes the operating environment of the OPC in three parts. The first part describes the major program delivery mechanisms; the second and third parts describe important internal and external factors affecting program delivery.

Major Program Delivery Mechanisms

Investigations and Inquiries

The OPC seeks to promote fair information management practices by both public and private sector organizations in Canada in accordance with two federal privacy laws. The Privacy Act was enacted in 1983, and PIPEDA, which began coming into effect in 2001, came into full force in 2004. The principal means of doing this is through complaint investigations, which are conducted by the OPC's Investigations and Inquiries Branch. The Branch investigates complaints from individuals alleging that their personal information has been collected, used or disclosed inappropriately.

In conducting this work, the Investigations and Inquiries Branch is supported by activities of other branches, such as the Legal Services and Policy Branch and the Research and Analysis Branch. The Legal Services and Policy Branch provides legal advice on the interpretation and application of both Acts and represents the OPC in matters that proceed before Federal Court. The Research and Analysis Branch provides investigators with research material to assist with the development of needed expertise in such areas as newly emerging technologies, which are the subject of an increasing number of complaints to the OPC.

The Investigations and Inquiries Branch also responds to inquiries from members of the general public, government institutions, private sector organizations, and the legal community, who contact the OPC on a wide variety of privacy-related issues.

Audits and Reviews

To safeguard Canadians' right to privacy, the OPC's Audit and Review Branch conducts compliance reviews under Section 37 of the Privacy Act. These reviews assess systems and practices for managing personal information from collection to disposal by federal departments and agencies. This work is intended to encourage the growth of fair information practices by federal government institutions. The OPC also has the mandate, under Section 18 of PIPEDA, to conduct audits of the personal information management practices in the private sector. The Audit and Review Branch is likewise supported by the Legal Services and Policy Branch and the Research and Analysis Branch, as needed.

Privacy Impact Assessments

The Government of Canada's Policy on Privacy Impact Assessments (PIAs) has added to the responsibilities of the OPC. Our role, as defined in the Policy, is to assess the extent to which a department's PIA has succeeded in identifying privacy risks associated with a project or initiative and to comment on the appropriateness of the measures proposed to mitigate identified risks. The OPC views PIAs as an integral part of the federal government privacy management framework.

Support to Parliament

The Commissioner acts as Parliament's advisor on privacy issues, bringing to the attention of Parliament issues that have an impact on the privacy rights of Canadians. We do this by tabling annual reports to Parliament, by appearing before Parliamentary Committees to provide legal and policy advice on the privacy implications of proposed legislation and government initiatives, and by researching and analyzing issues that we believe should be brought to Parliament's attention.

The OPC also assists Parliament to become better informed about privacy, acting as a resource or centre of expertise on privacy issues. This includes responding to a significant number of inquiries from Senators and Members of Parliament.

Public Education and Communications

The Privacy Commissioner is specifically mandated under PIPEDA to conduct public education activities to ensure that all parties in Canada are aware of the law and of the fair information practices it seeks to promote. This includes the business community, technology developers, and individuals who need knowledge of their rights in order to protect their privacy. There is also an ongoing need to raise awareness of privacy issues that arise in the federal public sector. Public outreach activities include, for example, undertaking public opinion research and media relations, speeches and participation in special events, the printing and dissemination of publications, and posting information on the OPC's Web site.

Research Program

The Research Program is an open and competitive contribution program to support the development of national privacy research capacity in the voluntary, academic and not-for-profit sectors. The purpose of the program is to catalyze research on privacy matters in Canada, to encourage collaboration among different communities, and to generate and transfer knowledge on the privacy impact of emerging technologies, and best practices for effective personal information management in the private and public sectors. The OPC also carries out in-house and contracted research on a broad spectrum of issues such as identity management, video surveillance, and electronic health records.

Internal Factors Affecting Program Delivery

As we enter fiscal year 2007-2008, the OPC moves forward with an increased budget, and new staff that brings with them new ideas and backgrounds. Our staff continues to demonstrate an unwavering commitment to protecting and enhancing the privacy rights of Canadians.

Being in an organizational development and staffing mode, the OPC must remain attentive and responsive to the needs of people and the requirement to continuously improve work processes and service delivery. The OPC is working to: adapt decision-making processes to manage in a more integrated fashion; find the balance between being more proactive in its approach to service delivery while remaining responsive to incoming demands; put in place more advanced knowledge management tools and enable opportunities for effective knowledge transfer; and integrate skills of existing and new staff. At the same time, the OPC is continuing to address its backlog of cases to improve its response time relating to investigations, inquiries, audit and review activities.

In sum, there is ongoing momentum in the organization as a result of changes implemented in recent years. This momentum offers the OPC an opportunity to hire and train new staff and align the organization so that all aspects of the OPC mandate are effectively and efficiently supported and resourced. We face the future as an organization that has been revitalized and has gained the reputation of not only being a centre of expertise, but an organization in which Parliament and Canadians can put their trust.

External Factors Affecting Privacy and the OPC

Opinion polling in Canada continues to show that, as a society, we are deeply concerned about privacy, and at times conflicted about the appropriate response to various social, political, and technological factors which threaten privacy. It is the role of this Office to help analyze, understand, and balance these conflicting societal pressures, in a climate where individuals can rapidly swing from supporting an initiative or value, to protesting it. Principal among the threats to privacy is technology. As a society, Canadians willingly embrace communications technology and innovation, and hope to stay on the cutting edge of such technologies as the Internet, remote sensing, and predictive profiling, while recognizing inherent privacy risks that require effective limits, controls and oversight.

The Internet presents a number of new privacy threats: the exposure of children and youth through online social networking sites, the compilation of behavioural profiles from harnessing search engines to collect data about individuals, and the exposure of individuals to the risks of identity theft and online fraud. New miniature computing devices, from radio frequency identification devices (RFIDs) to nanotechnology, will very soon revolutionize the supply chain and practically every item we deal with, as tags enable physical goods to communicate with readers and the Internet. It is impossible to overstate the transformative nature of this technology and its potential to invade the privacy of citizens and create a surveillance state. It may also enable us to grapple with enormous environmental and logistical challenges, from monitoring pine beetle invasions in remote regions to tracking defective medical devices, so finding solutions to the privacy problems must engage our attention.

The global war on terror and on organized crime has created a social and political climate where it has become accepted practice to retain transactional data, to install video cameras in previously free and open spaces, and to search this data for suspected persons. Software programs detect unusual behaviour patterns in both physical space and on the communications networks, and innocent citizens are singled out for scrutiny in an attempt to predict crime, not just detect it. This has implications beyond privacy to the foundations of our justice system and Charter of Rights, but it starts with information, which is our domain of interest.

The growing tolerance of the population for profiling and surveillance activities partly reflects the fears of an aging population that worries about crime, illegal immigration, and loss of power and control over information. In our scanning and research activities, the goal is to provide fact-based approaches to these issues, and inform the media and the public of the impacts of activities and technology which invade privacy, as well as shed light on policy alternatives. As the government prepares for potential emergencies, such as disaster recovery planning, increased public health surveillance in the event of a flu or SARS epidemic, or critical infrastructure surveillance measures, we seek to mitigate the privacy implications of management plans and the potential use of extraordinary powers.

We cannot do this in isolation. Part of our resource increase was to allow us to engage the many stakeholders (government departments, academics, the business community, the legal community, other data protection commissioners in Canada and abroad, civil society and individuals) in an attempt to build a stronger community working towards proactive solutions. These solutions include privacy enhancing technologies, better risk assessment, public information and awareness, research that analyses costs, benefits, and privacy impacts of new proposals.

There is an enormous challenge for those who defend privacy. Safety and security will always prevail over privacy values, until someone gets hurt. The situation in Canada with the Commission of Inquiry into the Actions of Canadian Officials in Relation to Maher Arar is a case in point in which incorrect information led a Canadian to be deported to and tortured in Syria. The speed of change is daunting, and the human response to change can be a failure to believe in the power of individuals to cope, to correct, and to reverse direction. The pressures of a globalized world bring us a myriad of potential partners but an overwhelming task of selection, focus, and harmonization of efforts.

It is the task of this Office to be a positive agent for change and for hope in the protection of privacy as a core human value that Canadians cherish. One of the reasons that Canada will host the 29th International Conference of Data Protection and Privacy Commissioners in Montreal in September 2007 is to provide an effective forum for discussing potentially common solutions to increasingly global issues.

2.2 Summary of OPC Plans and Priorities for 2007-2008

Having considered the present internal and external business environment surrounding the OPC, senior management established five (5) priorities to give focus to its activities and further advance towards the achievement of its single Strategic Outcome and its ultimate, intermediate and immediate outcomes (presented in Figure 2). The priorities have remained relatively stable since last year's Report on Plans and Priorities. The five priorities are presented below and the plans to deliver on each priority are described in the paragraphs that follow:

Strategic Outcome: The privacy rights of individuals are protected.

OPC Priorities for 2007-2008:

  1. Improve and expand service delivery
  2. Engage with Parliament on privacy issues
  3. Continue to promote Privacy Act reform and PIPEDA review
  4. Organize, host and evaluate the 29th International Conference of Data Protection and Privacy Commissioners
  5. Build organizational capacity

1. Improve and expand service delivery

The OPC has a client-centered approach and considers that it is critical to continue efforts to further improve and expand its service delivery. In line with commitments made in its business case, the OPC will work to make greater use of various tools available to proactively promote privacy compliance, while at the same time, significantly reduce backlogs and improve response times of complaint investigations and privacy impact assessment (PIA) reviews without compromising their quality. This is essential to sustain the renewed trust of Canadians in the OPC and our ability to protect their privacy rights. Fair, prompt and effective treatment of these files also provides a key opportunity for education and knowledge transfer.

Improved service delivery will be achieved through hiring new staff, increased automation and use of technology in processing files, and streamlining processes. A key activity for 2007-2008 will be to define performance standards for core activities such as responding to inquiries, conducting investigations, carrying out audits, and reviewing PIAs. In future years, the OPC will incorporate those standards to its operations and will be able to measure and report performance against its own standards, and eventually possibly against standards recognized internationally.

An expanded focus on service delivery in 2007-2008 will include continuing to increase the number of audits and follow-up audits of privacy systems and practices in both the public and private sectors. Audit and review activities determine compliance with privacy laws and lead to recommendations to implement information management practices in-line with modern principles of personal information protection. With the addition of new resources in the audit and review function, the volume of audit activity will increase from a past average of three or four projects a year to a total of eight planned audits to be initiated in 2007-2008. And we anticipate completing three other major audits started in fiscal year 2006-2007. While a 100% increase in volume is notable, audits will also be more comprehensive and effective as illustrated by the audit of the Canada Border Services Agency reported in June 2006. The OPC will also publish additional guidance materials to help public and private sector organizations comply with legislative requirements and improve privacy management practices.

2. Engage with Parliament on privacy issues

Parliamentarians rely on the Commissioner for advice, information and support relating to privacy issues. In 2007-2008, the OPC will continue to support Parliamentarians through the provision of useful and timely submissions and policy positions relating to potential privacy implications of proposed legislation and/or government initiatives.

The OPC will respond to inquiries of Parliamentarians and be more proactive in informing legislators and decision-makers of privacy issues on the basis of sustained knowledge about trends and emerging issues in the privacy field. As the reputation of the OPC continues to solidify as a centre of excellence, the Commissioner's advice and views may be solicited more frequently. Interventions before Parliamentary Committees to comment on legal and policy issues may also increase. The OPC is committed to providing sound legal and policy analyses and expertise to support Parliamentarians in their review of the privacy implications of bills.

3. Continue to promote Privacy Act reform and PIPEDA review

The OPC has pointed out on many occasions that the Privacy Act is long overdue for a fundamental reform. The Act came into effect in 1983 when there were no personal computers, no Internet, no cell phones, no geo-positioning systems, let alone biometrics and RFID chips or nanotechnology. It was crafted in the era of reel-to-reel computer tapes and paper files in filing cabinets, when trans-border data flow almost entirely was achieved through shipping goods, tapes or paper, not digital bits. The OPC will continue to promote Privacy Act reform by engaging Parliament as well as encouraging federal government institutions to adopt leading practices to respect the privacy rights of individuals and to protect their personal information.

As for PIPEDA, this Act includes a provision for a review every five years. In the summer of 2006, the OPC released a discussion paper on issues related to PIPEDA review. We received more than 60 submissions from organizations and individuals. In November 2006, the Standing Committee of Access to Information, Privacy and Ethics began its study of PIPEDA. The OPC appeared before the Committee along with a number of witnesses. The OPC continues to take an active role in the process.

4. Organize, host and evaluate the 29th International Conference of Data Protection and Privacy Commissioners

In September 2007, Canada will host the 29th International Conference of Data Protection and Privacy Commissioners (refer to our Web site for more information on the Conference at: www.privacyconference2007.gc.ca), bringing together representatives from the world of business, public administration, science, the IT industry as well as governmental and non-governmental organizations to discuss cutting-edge issues related to privacy and the protection of personal information. This will provide a unique opportunity to highlight and enhance Canada's international role in promoting privacy standards.

The OPC has already dedicated efforts to prepare for this major event through careful planning in 2006-2007. Focussing on engaging a broad cross-section of society to participate in the events planned, we have collaborated with four provincial commissioners who will host complementary events in their own regions, leading up to the conference. Working with federal government departments, we hope to bring a wide audience to the event, building on other meetings and activities. Workshops will engage not only the world's data commissioners and experts, but many stakeholders in Canada, fulfilling our need to involve them in the solutions to problems. Engaging civil society will also bring strong and unique perspectives to the debate, and will provide significant learning and networking opportunities. Conference papers will enrich our community in Canada and feed our public education program. The theme of the conference is Terra Incognita, as it truly is an unknown world to which we sail in this information age. In the months leading to the conference in 2007-2008, the OPC will intensify its efforts to ensure that this conference is a success. We will:

  • Invest resources to implement the conference strategy and key activities;
  • Engage OPC staff in activities, ensuring they benefit as a team from this learning and networking opportunity;
  • Implement procedures to host the conference, in cooperation with provincial and international colleagues;
  • Provide opportunities for the press to understand the issues and access the experts who will gather in Montreal;
  • Engage stakeholders across Canada and internationally;
  • Tie in the relevance of research generated through the OPC's Research Contributions Program and the excellent opportunity for knowledge transfer; and
  • Evaluate the outcome of the conference.

5. Build organizational capacity

The OPC is in development mode and will continue in 2007-2008 to dedicate considerable energy and effort to increase its organizational capacity to approved levels. In order to achieve success, our plan includes the following major components:

Finalize OPC organizational structures. In 2007-2008, we will continue to:

  • Review and revise the organizational structure, including the creation of regional offices;
  • Create and classify new positions;
  • Recruit applicants; and
  • Screen and select new staff.

Train and integrate new and existing staff. We will identify and provide training and development opportunities for existing and new staff, based on personal learning plans and organizational learning priorities. Our success also depends on our ability to build staff engagement through exemplary leadership and sound management practices.

Implement aspects of the new Federal Accountability Act that will have an impact on the OPC, namely the creation of an office to handle access to information and privacy requests. Other impacts, such as the increase in the number of organizations to be covered by the Privacy Act, may require a greater number of privacy investigators or other staff.

Improve OPC's infrastructure (e.g. Information Management / Information Technology, accommodations, policies and procedures). The OPC has completed implementation of a new structure to classify its information holdings. New procedures and guidelines will be developed and implemented in 2007-2008 to comply with the Management of Government Information Policy and the OPC will move forward to have all of its information in electronic format by scanning existing and new documents.

In terms of accommodations, the OPC will make some adjustments to its floor plans to optimise existing space and accommodate new and existing staff while working on a long-term accommodation plan. We will review our policies and procedures to ensure they are up-to-date and compliant with Treasury Board policies and other relevant legislation.

2.3 Link Between Priorities, Expected Results and Program Activities

The priorities, discussed in the previous section, serve to advance the achievement of the OPC's results over the next three fiscal years with an emphasis on 2007-2008. Priorities will be refined annually based on the OPC's changing environment. While the operating environment of the OPC evolves over time, its expected results (See OPC Results Framework in Figure 2 of this Report on Plans and Priorities) will remain relatively stable: the OPC results are based on its mandate and long-term vision of the four complementary roles vis-à-vis Parliamentarians, individuals, federal government institutions and private sector organizations.

The Results Framework is aligned to the OPC's Program Activity Architecture (PAA)2. The PAA provides the structure for planning and reporting on the OPC's activities. Our program has three operational activities aimed at achieving one strategic outcome on behalf of Canadians, plus a management activity to support the first three activities. Section 2.4 that follows: describes each Program Activity, presents the OPC's expected results by Program Activity and associates performance indicators to each expected result; and links Program Activities and results with the annual priorities for 2007-2008.


Strategic Outcome:

Protection of the privacy rights of individuals

Program Activities:

1. Compliance activities 2. Research and policy development 3. Public outreach
4. Management Excellence

2.4 Analysis by Program Activity

This section provides information on the OPC's outcomes, expected results and performance indicators on the basis of the Program Activity Architecture (PAA), and links the 2007-2008 priorities described in Section 2.2 to the Program Activities.

The OPC will implement its newly developed Results and Performance Measurement Framework using an incremental approach over the next few years. The performance indicators identified in this section are those against which the OPC will start measuring its performance in 2007-2008. More indicators identified in the OPC's comprehensive Results and Performance Measurement Framework will be introduced in future reports on plans and priorities as they become operational. In addition to 'performance' indicators that generate information about the extent of achievement of 'results', the OPC uses 'volume' indicators or statistics to collect relevant information about its 'activities'. The level of discussion of a report on plans and priorities does not warrant listing the volume indicators; those may, however, serve to report useful information in the departmental performance report.


Office of the Privacy Commissioner of Canada
Expected Result Performance Indicator
Ultimate Outcome for Canadians
The OPC plays a lead role in influencing federal government institutions and private sector organizations to respect the privacy rights of individuals and protect their personal information. Extent and direction of change in the privacy practices of federal government institutions and private sector organizations

 


Planned Resources 2007-2008 2008-2009 2009-2010
Financial Resources $19,711,000 $18,919,000 $18,937,000
Human Resources 154 FTEs 150 FTEs 150 FTEs

Program Activity 1: Compliance Activities

Activity Description

The OPC is responsible for investigating complaints and responding to inquiries received from individuals and organizations that contact the OPC for advice and assistance on a wide range of privacy-related issues. The OPC also assesses through audits and reviews how well organizations are complying with requirements set out in the two federal laws and provides recommendations on PIAs pursuant to the Treasury Board Secretariat policy. This activity is supported by a legal team that provides specialized legal advice and litigation support, and a research team with senior technical and risk assessment support.


Expected Results Performance Indicators
Intermediate Outcomes
Individuals receive effective responses to their inquiries and complaints. Timeliness of OPC responses to inquiries and complaints
Federal government institutions and private sector organizations meet their obligations under federal privacy legislation and implement modern principles of personal information protection. Extent to which audit, investigation and PIA review recommendations are accepted and implemented over time
Immediate Outcomes
The process to respond to inquiries and investigate complaints is effective and efficient. Timeliness of OPC responses to inquiries and complaints
The process to conduct audits and reviews is effective and efficient, including effective review of privacy impact assessments (PIAs) for new and existing government initiatives. Audits completed as scheduled and within allotted resources
% of PIA reviews completed within allotted time

 


Planned Resources 2007-2008 2008-2009 2009-2010
Financial Resources $11,139,000 $11,403,000 $11,405,000
Human Resources 107 FTEs 103 FTEs 103 FTEs

Priority for this Program Activity

Over the next three years, the OPC will advance work towards the achievement of the above outcomes by pursuing the following priority:


Priority Type
Improve and expand service delivery Ongoing

Program Activity 2: Research and Policy Development

Activity Description

The OPC serves as a centre of expertise on emerging privacy issues in Canada and abroad by researching trends and technological developments, monitoring legislative and regulatory initiatives, providing legal, policy and technical analyses on key issues, and developing policy positions that advance the protection of privacy rights. An important part of the work done involves supporting the Commissioner and senior officials in providing advice to Parliament on potential privacy implications of proposed legislation, government programs and private sector initiatives. Given the importance of information technology impacts, an important component of this work is analysis of IT initiatives embedded in projects.


Expected Results Performance Indicators
Intermediate Outcome
Parliamentarians and others have access to clear, relevant information, and timely and objective advice about the privacy implications of evolving legislation, regulations and policies. Number of potential privacy-relevant legislative initiatives and bills on which the OPC: (i) was consulted before the introduction and/or during the legislative review process and (ii) appeared before Parliamentary committees
Immediate Outcomes
The work of Parliamentarians is supported by an effective capacity to identify and research privacy issues, and to develop policy positions for the federal public and private sectors, which are respectful of privacy. Key privacy issues identified and positions articulated to influence the evolution of bills through the drafting stage at the departmental level and the legislative process through Parliament
Knowledge about systemic privacy issues in Canada is enhanced, serves to advance the interpretation and application of federal privacy laws, and improves privacy management practices. Key privacy issues identified, analysed, and potential impacts assessed

 


Planned Resources 2007-2008 2008-2009 2009-2010
Financial Resources $4,534,000 $4,078,000 $4,079,000
Human Resources 24 FTEs 24 FTEs 24 FTEs

Priorities for this Program Activity

Over the next three years, the OPC will advance work towards the achievement of the above outcomes by pursuing the following priorities:


Priority Type
Engage with Parliament on privacy issues Ongoing
Continue to promote Privacy Act reform and PIPEDA review Previous
Organize, host and evaluate the 29th International Conference of Data Protection and Privacy Commissioners Previous

Program Activity 3: Public Outreach

Activity Description

The OPC plans and implements a number of public education and communications activities, including speaking engagements and special events, media relations, and the production and dissemination of promotional and educational material.


Expected Results Performance Indicators
Intermediate Outcomes
Individuals have relevant information about privacy rights and are enabled to guard against threats to their personal information. Reach of target audience with OPC public education materials
Federal government institutions and private sector organizations understand their obligations under federal privacy legislations. Degree of organizational awareness and understanding of privacy responsibilities3
Immediate Outcomes
Individuals receive and have easy access to relevant information about privacy and personal data protection, enabling them to better protect themselves and exercise their rights. Reach of target audience with OPC public education materials
Federal government institutions and private sector organizations receive useful guidance on privacy rights and obligations, contributing to better understanding and enhanced compliance. Reach of organizations with OPC policy positions, promotional activities and promulgation of best practices

 


Planned Resources 2007-2008 2008-2009 2009-2010
Financial Resources $4,038,000 $3,438,000 $3,453,000
Human Resources 23 FTEs 23 FTEs 23 FTEs

Priorities for this Program Activity

Over the next three years, the OPC will advance work towards the achievement of the above outcomes by pursuing the following priorities:


Priority Type
Engage with Parliament on privacy issues Ongoing
Continue to promote Privacy Act reform and PIPEDA review Previous
Organize, host and evaluate the 29th International Conference of Data Protection and Privacy Commissioners Previous

Other Activities: Management Excellence

Activity Description

The OPC continues to enhance and improve its management practices in order to meet the highest standards of performance and accountability. The resources associated with Corporate Services have been apportioned to the three first Program Activities, which they support. All managers of the OPC are expected to take responsibility for the expected results, and to integrate the necessary activities in their operational plans.


Expected Results Performance Indicators
Intermediate Outcome
The OPC achieves a standard of organizational excellence, and managers and staff apply sound business management practices. Ratings against MAF (as being the expectations for high organizational performance in modern public service management)
Immediate Outcomes
Key elements of the OPC Management Accountability Framework (MAF) are integrated into management practices and influence decision-making at all levels. Ratings against MAF (as being the expectations for high organizational performance in modern public service management)
The OPC has a productive, principled, sustainable and adaptable workforce that achieves results in a fair, healthy and enabling workplace. Employee satisfaction; number of grievances received; quality of labour relations; retention of staff
HR management practices reflect new accountabilities stemming from Public Service Modernization Act and Public Service Employment Act. Full, unconditional staffing delegation from PSC; HR planning integrated into business planning at the OPC
Managers and staff demonstrate exemplary professional and ethical conduct in all of their work, and are responsive to the highly visible and complex nature of the environment in which they operate. Feedback from employees on fairness, respect and engagement
The performance of the OPC is defined, measured and reported upon regularly in a meaningful and transparent manner. OPC reports, particularly RPP and DPR, are well received by Central Agencies and stakeholders

Priorities for this Program Activity

Over the next three years, the OPC will advance work towards the achievement of the above outcomes by pursuing the following priority:


Priority Type
Build organizational capacity Previous

 




Section III: Supplementary Information

3.1 Organizational Information

The Investigations and Inquiries Branch is responsible for investigating complaints received from individuals and incidents of mismanagement of personal information. The Branch's Inquiries Division responds to thousands of inquiries annually from the general public and organizations.

The Audit and Review Branch audits organizations to assess their compliance with the requirements set out in the two federal privacy laws. The Branch also analyses and provides recommendations on privacy impact assessment reports (PIAs) submitted to the OPC pursuant to the Treasury Board Secretariat Policy on PIAs.

The Research and Analysis Branch is responsible for researching privacy and technology issues to support policy development, investigation and audit, and the public education program. The Branch administers the research program, which was launched in 2004 to support research into, and the promotion of, the protection of personal information. The branch supports international outreach activities and stakeholder engagement activities.

The Public Education and Communications Branch focuses on providing strategic advice and support for communications and public education activities for the OPC. In addition, the Branch plans and implements public education and communications activities, including analyzing public perceptions of privacy issues through media monitoring, public opinion polling, media relations, publications, and the OPC Web site.

The Legal Services and Policy Branch provides specialized legal advice to the Commissioner, the Investigations and Inquiries Branch and the Audit and Review Branch to support the interpretation and application of both enabling laws. The Legal Services and Policy Branch represents the OPC in privacy matters that proceed before the Federal Courts, conducts legal and policy review and analyses of Bills tabled in Parliament and generally advises the Commissioners on a variety of corporate legal matters. The Branch also develops and advises on legal/policy positions for the OPC.

Human Resources

Human Resources is responsible for the provision of strategic advice, management and delivery of comprehensive human resource management programs in areas such as staffing, classification, staff relations, human resource planning, learning and development, employment equity, official languages and compensation.

The priorities for the HR Branch in the 2007-2008 fiscal year will be to:

  • Implement the human resources and staffing strategy that addresses the OPC's capacity building needs including staff recruitment and development, retention and succession planning needs;
  • Complete implementation of business case requirements, which includes a review of branch design, staffing and classification requirements as a result of the newly approved resources;
  • Continue to work with the Canada School of Public Service and other service providers on training and information sessions for all staff as part of the OPC learning environment;
  • Continue implementation of the requirements under the new Public Service Employment Act and the Public Service Modernization Act; and
  • Integrate human resources planning with overall strategic planning and identify key risks, challenges and necessary actions; enhance HR monitoring and reporting capacity in all disciplines and develop essential HR policies and guidelines as outlined in the corporate policy development process.

Corporate Services

The Corporate Services Branch, headed by the Chief Financial Officer, provides advice and integrated administrative services (corporate planning, finance, information management / technology and general administration) to managers and staff.

The Branch's most important priority in 2007-2008 will be to build organizational capacity through leading phase two (year 2) implementation of the business case that will enable the OPC to continue fulfilling its mandate efficiently and effectively.

The Corporate Services Branch will also lead a number of important management initiatives linked to the OPC's goal of achieving a standard of organizational excellence and applying sound business management practices. The OPC uses the Management Accountability Framework (MAF) as a tool to identify management areas requiring reinforcement and to put in place improved management practices. Initiatives planned for this planning period are as follows:

  • Implement the OPC's new performance measurement framework using an incremental approach;
  • Continue to advance the management of integrated risk through the:
    • Completion and implementation of the Business Continuity Plan;
    • Establishment of an internal audit function for the OPC (in line with the requirements of the Treasury Board Internal Audit Policy), and
    • Management of risks as identified in the OPC's corporate risk profile;
  • Strengthen information management capacity by recognizing information as a strategic resource and through continued collaboration with internal and external stakeholders; and
  • Oversee the financial and management aspects of the 29th International Conference of Data Protection and Privacy Commissioners.

3.2 Resource Tables

Table 1: Departmental Planned Spending and Full Time Equivalents


($000) Planned Spending
2006-2007
Planned Spending
2007-2008
Planned Spending
2008-2009
Planned Spending
2009-2010
Vote 45 - Operating expenditures 14,460 17,482 16,747 16,765
Statutory - Contributions to employee benefit plans 1,838 2,229 2,172 2,172
Total Main Estimates 16,298 19,711 18,919 18,937
Adjustments:
Funding provided through transfers from TB Vote 5 and Governor General Special Warrants in lieu of Supplementary Estimates for activities under PIPEDA
 
Total Planned Spending 16,298 19,711 18,919 18,937
Plus: Cost of services received without charge
Accommodation provided by Public Works and Government Services Canada (PWGSC) 990 958 983 997
Contributions covering employers' share of employees' insurance premiums and expenditures paid by TBS (excluding revolving funds) 774 840 818 818
Audit of the financial statements by the Office of the Auditor General of Canada 90 90 90 90
Cost of Program 18,152 21,599 20,810 20,842
 
Full Time Equivalents 125 154 150 150

Explanation of Trends

The planned increased resources are being phased-in over two years, 2006-2007 and 2007-2008. The planned spending for those two years also includes the one-time costs of fitting up offices and systems for the increased staff; in addition resources are temporarily provided in those years to eliminate the backlog in Investigations and Inquiries. The planned spending for 2008-2009 represents the resource utilization on an on-going basis.

Table 2: Resources by Program Activity in 2007-2008


Program Activity ($000) Operating Contributions Total
Main Estimates
1. Compliance Activities 11,139 11,139
2. Research and Policy Development 4,034 500 4,534
3. Public Outreach 4,038 4,038
Total 19,211 500 19,711

Link to the Whole of Government Framework: the OPC Strategic Outcome and all three Program Activities support the Social Affairs outcome area of the Framework, more specifically the following outcome: a diverse society that promotes linguistic duality and social inclusion.

Table 3: Resource Requirements by Branch in 2007-2008


Branches ($000) 1. Compliance Activities 2. Research and Policy Development 3. Public Outreach Total
Offices of the Commissioner and Assistant Commissioners 1 616 616 616 1,848
Investigations and Inquiries 3,987     3,987
Research and Analysis   2,260   2,260
Audit and Review 2,291     2,291
Legal Services and Policy 1,099 471   1,570
Regional Offices 226   528 754
Communications     1,743 1,743
Corporate Services 2,090 934 909 3,933
Human Resources 563 132 126 821
ATIP Office2 267 121 116 504
Total 11,139 4,534 4,038 19,711

1 Costs associated with the 29th International Conference of Data Protection and Privacy Commissioners are shown under the Office of the Commissioner.

2 Access to Information and Privacy

The Offices of the Commissioner and Assistant Commissioners include the costs of federal-provincial coordination and international activities. The OPC budgets centrally for many of its costs. For example, Corporate Services Branch includes the costs of information management and information technology (computer systems and computer equipment for all employees), office furniture and supplies and telecommunications. Human Resources Branch includes the cost of employee training.

3.3 Sources of Additional Information

Legislation Administered by the Privacy Commissioner


Privacy Act R.S.C. 1985, ch. P21, amended 1997, c.20, s. 55
Personal Information Protection and Electronic Documents Act 2000, c.5

Statutory Annual Reports, other Publications and Information

Statutory reports, publications and other information are available from the Office of the Privacy Commissioner of Canada, Ottawa, Canada K1A 1H3; tel.: (613) 995-8210 and on the OPC's Web site at www.privcom.gc.ca

  • Privacy Commissioner's annual reports
  • Reports on Plans and Priorities from previous years
  • Departmental Performance Report to Parliament for the period ending March 31, 2006
  • Your Privacy Rights: A Guide for Individuals to the Personal Information Protection and Electronic Documents Act
  • Your Privacy Responsibilities: A Guide for Businesses and Organizations to the Personal Information Protection and Electronic Documents Act

Contact for Further Information on the Report on Plans and Priorities

Mr. Tom Pulcine
Director General, Corporate Services/CFO
Office of the Privacy Commissioner of Canada
Place de Ville, Tower B
112, Kent St., Suite 300
Ottawa, Ontario K1A 1H3
Telephone: (613) 996-5336
Facsimile: (613) 947-6850


1 Federal government institutions include all entities (line departments, central agencies, ministries of state, and other government institutions) scheduled in the Privacy Act.

2 The structure of the PAA has remained unchanged (since the last RPP); only the titles of the program activities have been reworded.

3 This particular performance indicator will be implemented in stages, beginning in 2007-2008, with select audiences/groups polled each year.