ARCHIVED - Office of the Privacy Commissioner of Canada - Report

• Previous Page
• Table of Contents
• Next Page

This page has been archived.

Section II: Analysis of Program Activities

Strategic Outcome

All OPC efforts and activities are directed towards achieving the organization’s single Strategic Outcome, the protection of individuals’ privacy rights. The Office plays a leadership role in encouraging organizations that handle Canadians’ personal information to respect the privacy rights of individuals. Others who contribute to this mission include provincial and territorial privacy commissioners, other national data-protection authorities, privacy advocacy groups, chief privacy officers, professional associations, consumer representatives, academics, Parliamentary committees, and federal departments and agencies.

Strategic Outcome:
The privacy rights of individuals are protected.

Expected Result	Performance Indicator	Target
Ultimate Outcome for Canadians
Through OPC’s leadership, Canadian federal government institutions and private-sector organizations better respect the privacy rights of individuals and better protect their personal information.	Improved privacy protection through positive change to the privacy practices of Canadian federal government institutions and private-sector organizations, as a result of OPC actions	Some improvement from the 2010-2011 baseline, representing ‘3’ on a scale of ‘1 to 5’ by March 31, 2013
Performance Measurement Strategy
This “umbrella indicator” of the influence of the OPC is measured by comparing the annual OPC performance to the 2010-2011 baseline for the following six targets: 90% of investigation recommendations implemented within set timelines (refer to Program Activity 1) 75% of audit recommendations fully implemented two years after final report (refer to Program Activity 1) 75% of the privacy-relevant bills and issues (high and medium levels) proceed through the legislative process having received OPC’s views (refer to Program Activity 2); 75% of participants to the OPC annual PIA workshop acquired a better understanding of the requirement to assess privacy risks of federal programs (refer to Program Activity 3); 90% of private-sector organizations are aware of their obligations under federal privacy legislation (refer to Program Activity 3); 20% of Canadians feel they know about their privacy rights (refer to Program Activity 3). The Office measures the influence of its actions on changes to privacy practices in Canada and reports on results in its annual Departmental Performance Report. The OPC uses the following five point scale to determine overall success with regard to the six above-listed indicators: Regress: four or more of the six indicators are under the baseline. Status quo: five or six indicators are at baseline (the other could either be above or under the baseline). Some improvement: one or two of the six indicators are above the baseline, most of the other four or five indicators are at baseline, with no more than one indicator is under the baseline. Satisfactory improvement: three or four of the six indicators are above the baseline, most of the other two or three indicators are at baseline, the rest could be under the baseline. Significant improvement: five or six indicators are above the baseline, the one other indicator is at baseline.

The OPC’s four Program Activities (compliance activities, research and policy development, public outreach, and internal services) are described in the remainder of Section II with an overview of each; a table with the expected results for Canadians, the performance indicators and targets (including measurement strategy); the allocated financial and human resources; and planning highlights for 2012-2013.

The performance measurement framework (PMF) enables the Office to supplement qualitative approaches to performance reporting with quantitative measures of progress toward expected results and the Strategic Outcome. The OPC regularly assesses the implementation of the PMF and makes adjustments as needed to ensure that indicators are measurable and provide useful information for decision-making and accountability. This Report on Plans and Priorities reflects the OPC’s revised PMF, with some new or modified expected results, performance indicators and targets.

Program Activity 1: Compliance Activities

Activity Description

The OPC is responsible for investigating privacy-related complaints and responding to inquiries from individuals and organizations. Through audits and reviews, the OPC also assesses how well organizations are complying with requirements set out in the two federal privacy laws, and provides recommendations on Privacy Impact Assessments (PIAs), pursuant to Treasury Board policy. This activity is supported by a legal team that provides specialized advice and litigation support, and a research team with senior technical and risk-assessment support. http://www.tbs-sct.gc.ca/est-pre/20122013/me-bpd/docs/me-bpd-eng.pdf

Program Activity 1: Compliance Activities

Expected Results	Performance Indicators (Performance Measurement Strategy)	Targets (by March 31, 2013)
Intermediate Outcomes
Federal government institutions and private-sector organizations meet their obligations under federal privacy legislation and implement modern practices of personal information protection.	Percentage of investigation recommendations implemented within set timelines (Tracking and analysis of responses to investigation reports)	90 percent
	Percentage of audit recommendations fully implemented two years after publication of the final audit report (Tracking and analysis of responses to audit reports)	75 percent
Immediate Outcomes
Individuals receive timely and effective responses to their inquiries and complaints.	Percentage of information requests responded to within established service standards (Tracking and analysis of Office statistics on turnaround time)	90 percent
	Percentage of complaints resolved through early-resolution strategies, where no formal investigation is commenced (Tracking and analysis of the disposition of complaints)	20 percent
	Percentage of complaints responded to within 12 months of acceptance (Tracking and analysis of Office statistics on response time for complaints)	95 percent
Federal government institutions and private-sector organizations receive advice and recommendations to improve their privacy practices, in compliance with federal privacy legislation and policies.	Percentage of PIA consultations/ recommendations that result in an added privacy protection for government programs/initiatives (Tracking and analysis of the privacy outcome from the PIA consultations/ recommendations)	75 percent
	Percentage of audits completed within planned timelines (Tracking and analysis of time allotted to audits compared to planned times)	90 percent
	Percentage of PIA reviews completed within 120 days of receipt (Tracking and analysis of time allotted to PIA reviews against standard)	70 percent

Allocated Financial and Human Resources for Program Activity 1

	Forecast Spending 2011-2012	Planned Spending
		2012-2013	2013-2014	2014-2015
Financial Resources ($000)	10,391	10,366	10,366	10,366
Planned Human Resources (FTEs)		87	87	87

Planning Highlights for Program Activity 1

While continuing to work toward the Compliance Activities outcomes (as identified in the above outcomes table) through its usual ongoing activities, the OPC will focus on the following initiatives in 2012-2013 and beyond to deliver on the organizational priorities and associated key commitments (presented in Section I):

• Update and strengthen the organization’s complaint intake and investigation processes, with a view to providing service to Canadians in a more efficient and effective manner, namely through strengthening capacity building and procedures, implementing early resolution of complaints, efficiently using resources in the Toronto office, and incorporating alternative dispute resolution delivery methods, where appropriate;
• Improve the capability of the case management system through a business process review, and develop new reporting tools to track performance (e.g. a dashboard report);
• Enhance the Office’s technological support capacity through a larger team of technologists and an expanded state-of-the-art testing laboratory;
• Implement a new systematic quality control program to improve the quality and transferability of data and knowledge created in the course of investigations;
• Put in place processes and systems enabling the OPC to deliver service to Canadians as required under Canada’s anti-spam legislation and recent amendments to PIPEDA;
• Implement new processes and procedures to coordinate and share information, and to perform joint or collaborative investigations with provincial/territorial and international data protection agencies;
• Conduct public sector audits examining access controls and carry out follow-up to audits of federal personal information disposal practices, the protection of personal information in the face of wireless technology, and the privacy practices of a national retailer;
• Select reviews of Privacy Impact Assessments (PIAs) using a triage method that gives priority to compliance-related issues pertaining to the OPC’s priority privacy issues;
• Deliver a PIA case study workshop to federal government institutions, offering practical, hands-on guidance on how to approach the conduct of PIAs and assess risks to privacy.

Program Activity 2: Research and Policy Development

Activity Description

The OPC serves as a centre of expertise on emerging privacy issues in Canada and abroad by researching trends and technological developments, monitoring legislative and regulatory initiatives, providing legal, policy and technical analyses on key issues, and developing policy positions that advance the protection of privacy rights. An important part of the work involves supporting the Commissioner and senior officials in providing advice to Parliament on potential privacy implications of proposed legislation, government programs, and private-sector initiatives. http://www.tbs-sct.gc.ca/est-pre/20122013/me-bpd/docs/me-bpd-eng.pdf

Expected Results	Performance Indicators (Performance Measurement Strategy)	Targets (by March 31, 2013)
Intermediate Outcomes
Public- and private-sector stakeholders are enabled to develop policies and initiatives that respect privacy rights.	Percentage of positive feedback from stakeholders about the usefulness of OPC policy guidance (Tracking and analysis of stakeholders’ feedback to OPC’s policy guidance via an electronic survey)	70 percent
Immediate Outcomes
Parliamentarians are able to draw on OPC expertise to identify and address privacy issues.	Percentage of bills and issues with a high or medium relevance to privacy that receive the OPC’s views in the course of the legislative process (Tracking of statistics on high and medium privacy-relevant bills and issues: total number on which the OPC gave its views, either through Parliamentary committee appearances, submissions or letter)	75 percent
Knowledge about privacy issues is advanced.	Increased take-up of OPC research (Statistics on the number of website visits to OPC research papers or their URL links)	Annual increase relative to previous year

Allocated Financial and Human Resources for Program Activity 2

	Forecast Spending 2011-12	Planned Spending
		2012-13	2013-14	2014-15
Financial Resources ($000)	5,206	5,195	5,195	5,195
Planned Human Resources (FTEs)		19	19	19

Planning Highlights for Program Activity 2

While continuing to work toward the Research and Policy Development outcomes (as identified in the above outcomes table) through its usual ongoing activities, the OPC will focus on the following initiatives in 2012-2013 to deliver on the organizational priorities and associated key commitments (presented in Section I):

• Provide timely assessments of emerging technologies through laboratory testing as well as additional knowledge obtained by leveraging relationships with other data protection authorities;
• Develop policy positions with respect to the upcoming, legislatively-mandated Parliamentary review of PIPEDA;
• Implement a new strategic re-orientation of the OPC Contribution Program with greater emphasis on enabling the uptake and application of research results by relevant end-users;
• Continue to play a leadership role in advising the Organisation for Economic Co-operation and Development (OECD) on possible revisions to its Guidelines on the Protection of Privacy and Transborder Flows of Personal Data;
• Develop and publish policy guidance for public- and private-sector organisations, including best practices for protecting privacy in the new “app economy”.

Program Activity 3: Public Outreach

Activity Description

The OPC delivers public education and communications activities, including speaking engagements and special events, media relations, and the production and distribution of promotional and educational material. Through public outreach activities, individuals are informed about privacy and personal data protection, enabling them to protect themselves and exercise their rights. The activities also allow organizations to understand their obligations under federal privacy legislation. http://www.tbs-sct.gc.ca/est-pre/20122013/me-bpd/docs/me-bpd-eng.pdf

Expected Results	Performance Indicators (Performance Measurement Strategy)	Targets (by March 31, 2013)
Federal government institutions and private-sector organizations better understand their obligations under federal privacy legislation and individuals better understand their rights.	Percentage of participants in the annual OPC PIA workshop who feel they acquired a better understanding of the requirement to assess privacy risks of federal programs (Analysis of results from electronic survey of participants to the OPC annual PIA workshop organized)	75 percent
	Percentage of private-sector organizations that are moderately or highly aware of their obligations under federal privacy legislation (Analysis of results from biennial polling of private industry)	85 percent
	Percentage of Canadians who feel they know about their privacy rights (Analysis of results from biennial public opinion poll)	20 percent
Immediate Outcomes
Individuals have access to relevant and timely information to protect their privacy rights.	Annual increase in website visits (Tracking and analysis of statistics on web site traffic)	Visits to OPC websites increase year over year
Federal government institutions and private-sector organizations have access to useful information about their privacy responsibilities.	Reach of target audiences with public education initiatives (Comparison between ‘intended’ reach with public education initiatives and ‘actual’ reach)	70 percent

Allocated Financial and Human Resources for Program Activity 3

	Forecast Spending 2011-12	Planned Spending
		2012-13	2013-14	2014-15
Financial Resources ($000)	3,976	3,969	3,969	3,969
Planned Human Resources (FTEs)		24	24	24

Planning Highlights for Program Activity 3

While continuing to work toward the Public Outreach outcomes (as identified in the above outcomes table) through its usual ongoing activities, the OPC will focus on the following initiatives in 2012-2013 to deliver on the organizational priorities and associated key commitments (presented in Section I):

• Develop a better understanding of Canadians’ views of privacy, particularly in the online environment;
• Develop and/or implement communication strategies and efforts to fulfil the Office’s new responsibilities under Canada’s anti-spam legislation and provide guidance to individuals and organizations on how to protect their privacy and personal information in the face of related cyber threats;
• Participate in events that provide OPC technologists with a forum to educate participants on privacy issues related to a specific industry or sector;
• Contribute to public dialogue on policy and legislative initiatives affecting privacy, namely through publishing articles and conducting media outreach, to broaden the public’s perspective on matters relating to the four priority privacy issues of information technology, public safety, identity integrity and protection, and genetic information;
• Focus communication efforts on youth and their parents and educators, seniors and new Canadians among individuals, and small- and medium-sized enterprises, while also informing federal departments and agencies and other federally-regulated organizations;
• Broaden the range of the Office’s youth outreach activities by promoting newly created tools to equip educators of children in grades four through 12 with useful information and guidance about protecting personal information and privacy online, while also continuing interaction with the OPC’s youth advisory panel;
• Launch and promote a graphic novel designed to engage youth about online privacy in a new and innovative way;
• Expand the scope of the outreach activities targeted to industries from the private-sector to further improve compliance with PIPEDA.

Program Activity 4: Internal Services

Activity Description

Internal Services are groups of related activities and resources that support the needs of programs and other corporate obligations of an organization. As a small entity, the OPC’s internal services include two sub-activities: governance and management support, and resource management services (which also incorporate asset management services). Communications services are not included in Internal Services but rather form part of Program Activity 3 – Public Outreach. Similarly, legal services are not included in Internal Services at OPC, but are covered under Program Activity 1 – Compliance Activities, and Program Activity 2 – Research and Policy Development. http://www.tbs-sct.gc.ca/est-pre/20122013/me-bpd/docs/me-bpd-eng.pdf

Expected Results	Performance Indicators (Performance Measurement Strategy)	Targets (by March 31, 2013)
The OPC achieves a standard of organizational excellence, and managers and staff apply sound business management practices.	Percentage of the Management Accountability Framework (MAF) areas rated strong or acceptable (Review of results from the biennial MAF self-assessment exercise and annual progress reports)	70 percent

Allocated Financial and Human Resources for Program Activity 4

	Forecast Spending 2011-12	Planned Spending
		2012-13	2013-14	2014-15
Financial Resources ($000)	5,086	5,076	5,076	5,076
Planned Human Resources (FTEs)		46	46	46

Planning Highlights for Program Activity 4

The OPC will continue to work toward achieving and maintaining a standard of organizational excellence and have managers and employees apply sound business management practices. Over the next three years, and more particularly in 2012-2013, the OPC will sustain the organizational capacity through continuous improvement (its third organizational priority) by pursuing the following Internal Services activities, in addition to its usual ongoing activities:

• Build a changeable organization through a review of compliance functions (investigations, privacy impact assessments, audits) in relation to service demand to determine the adequacy of resourcing to meet requirements;
• Embed a uniform approach to all initiatives involving significant change through the roll-out and integration of the OPC’s change-management strategy and accompanying tools;
• Complete integration of recent changes to the Office’s organizational design to institute newly mandated responsibilities (e.g. Canada’s anti-spam legislation) and service improvements, notably the redesigned Information Centre;
• Review, evaluate and assess business-driven training needs to explore the development of a unique OPC curriculum for training, and further refine the talent management program launched in 2011-2012;
• Implement a revised and streamlined suite of human resource policy instruments, processes and tools that support OPC priorities and align with government-wide initiatives such as Common Human Resources Business Processes and Administrative Services Review;
• Enhance collaboration, reduce duplication of efforts and facilitate knowledge-transfer between staff through:
  • the continued development of Sharepoint sites to post documents of common interest, particularly for horizontal initiatives;
  • the “privacy conversations” series which seeks to encourage internal dialogue between OPC staff and specialized experts on topical issues;
  • a new concerted effort to improve the internal dissemination of research results from the OPC Contribution Program and information from the triage of PIAs based on the four priority privacy issues;
• Encourage increased information exchanges resulting from participation in internal working groups on the four priority privacy issues and other ad hoc groups established to examine particular issues, regular inter-branch dialogue (such as biweekly Policy and PIA meetings), internal legal training sessions for investigators and information officers and internal policy workshops
• Introduce the ability to more efficiently respond to public information requests electronically in addition to mail, facsimile and telephone;
• Broaden the utilisation of database software to enable faster production of communication materials and more timely response to public and media information requests;
• Expand the use of the newly developed subject taxonomy for improved standardization of terminology throughout the OPC;
• Increase capacity of laboratory facilities to provide timely, relevant results in meeting anticipated demand brought on by the introduction of Canada’s anti-spam legislation and the overall increase of technology-related privacy issues.

• Previous Page
• Table of Contents
• Next Page