ARCHIVED - Office of the Privacy Commissioner of Canada - Report
This page has been archived.
Archived Content
Information identified as archived on the Web is for reference, research or recordkeeping purposes. It has not been altered or updated after the date of archiving. Web pages that are archived on the Web are not subject to the Government of Canada Web Standards. As per the Communications Policy of the Government of Canada, you can request alternate formats on the "Contact Us" page.
2012-13
Report on Plans and Priorities
Office of the Privacy Commissioner of Canada
The original version was signed by
The Honourable Robert D. Nicholson, P.C., Q.C., M.P.
Minister of Justice and Attorney General of Canada
Table of Contents
Message from the Privacy Commissioner of Canada
Section I: Organizational Overview
- Raison d’être
- Responsibilities
- Strategic Outcome and Program Activity Architecture (PAA)
- Alignment of PAA to Government of Canada Outcomes
- Organizational Priorities
- Risk Analysis
- Planning Summary
- Expenditure Profile
- Estimates by Vote
Section II: Analysis of Program Activities
- Strategic Outcome
- Program Activity 1: Compliance Activities
- Program Activity 2: Research and Policy Development
- Program Activity 3: Public Outreach
- Program Activity 4: Internal Services
Section III: Supplementary Information
Section IV: Other Items of Interest
Message from the Privacy Commissioner of Canada
I am pleased to present our 2012-13 Report on Plans and Priorities, which sets out the strategic directions, priorities, expected results and spending estimates for the Office of the Privacy Commissioner of Canada ( OPC) for the coming fiscal year.
The privacy landscape is evolving constantly and, particularly as Canadians live more of their lives online, public interest in issues associated with personal information protection has never been higher. These factors call upon our Office to be adaptable and responsive to the needs of Canadians.
As the new fiscal year unfolds, we will continue focusing on the four priority areas we feel pose the greatest risks to privacy: information technology; public safety; identity integrity and protection; and genetic information. Each of these issues has at least two important things in common; each has tremendous implications for privacy and neither one are bounded by our borders. In general, and with online issues in particular, privacy matters are global in scope. This is why the information sharing provisions of Canada’s anti-spam law are so important. During the year, we will introduce a new process and procedure to perform joint or collaborative investigations with international partners and develop enhanced protocols for sharing information with provincial/territorial and international data protection agencies.
We will monitor the progress of Bill C-12, An Act to amend the Personal Information Protection and Electronic Documents Act ( PIPEDA), with a view to determining what operational changes may be required within our Office should the bill, which would introduce mandatory data breach notification requirements, become law. We will continue preparations for the second mandated five-year parliamentary review of PIPEDA. In the realm of public safety, we will monitor the implementation of the Beyond the Border Action Plan and provide advice on how to mitigate any risks posed by its particular initiatives to the privacy of Canadians. On the same note, we will continue to provide advice to Parliamentarians on proposed lawful access legislation.
In addition to advising Parliamentarians on how legislative proposals and other government initiatives may impact privacy, we will continue with outreach efforts to the federal public service to ensure that senior leaders along with staff who design policies and administrate programs are engaged and well-versed on how to best identify and mitigate risks to privacy in their endeavours. Further, we will continue and deepen our efforts to reach out to youth, parents and educators on protecting privacy and personal information in the online world.
Further, we will finalize preparation for the full coming into force of Canada’s anti-spam law, which will see our Office responsible for enforcing provisions regarding the collection of personal information through illicit access to other people’s computer systems and electronic address harvesting, where bulk e-mail lists are compiled through mechanisms including the use of computer programs to automatically mine the Internet for addresses.
Lastly, we will carry out our work mindful of Canadians’ expectations. Today’s economic realities make it incumbent for all organizations, be they in the private or public sector, to seek out efficiencies to make best use of resources. As a result, we are committed to find efficiencies within our operations while maintaining the best possible level of service to Canadians. Further toward this end, we will work at sustaining our organizational capacity through continuous improvement, more specifically to strengthen our knowledge management and embrace change in our management practices.
The original version was signed by
Jennifer Stoddart
Privacy Commissioner of Canada
Section I: Organizational Overview
Raison d'être
The mandate of the Office of the Privacy Commissioner of Canada ( OPC) is to oversee compliance with the Privacy Act, which covers the personal information-handling practices of federal government departments and agencies, the Personal Information Protection and Electronic Documents Act ( PIPEDA), Canada’s private-sector privacy law, along with some aspects of Canada’s anti-spam law. The OPC’s mission is to protect and promote the privacy rights of individuals1.
Responsibilities
As an Agent of Parliament, the Privacy Commissioner of Canada reports directly to the House of Commons and the Senate. The Commissioner’s powers to further the privacy rights of Canadians include:
- investigating complaints, conducting audits and pursuing court action under the Privacy Act and PIPEDA;
- publicly reporting on the personal information-handling practices of public- and private-sector organizations;
- supporting, undertaking and publishing research into privacy issues; and
- promoting public awareness and understanding of privacy issues.
The Commissioner works independently of the government to investigate complaints from individuals with respect to the federal public sector and the private sector. While the focus is on mediation and conciliation, if voluntary co-operation does not result, the Commissioner has the power to summon witnesses, administer oaths, and compel the production of evidence. In cases that remain unresolved, the Commissioner may seek an order from the Federal Court to rectify the situation.
Strategic Outcome and Program Activity Architecture (PAA)
In line with its mandate, the OPC pursues the protection of the privacy rights of individuals as its Strategic Outcome. Toward that end, the Office’s program activity architecture is composed of three operational activities and one management activity. The PAA diagram below presents information at the program activity level:
| Strategic Outcome | The privacy rights of individuals are protected. | ||
|---|---|---|---|
| Program Activity | 1. Compliance Activities | 2. Research and Policy Development | 3. Public Outreach |
| 4. Internal Services | |||
Alignment of PAA to Government of Canada Outcomes
Federal departments are required to report on how their PAA aligns with Government of Canada Outcomes. The Privacy Commissioner, however, being independent from government and reporting directly to Parliament, is not obliged to make such alignment. The Strategic Outcome and the expected results from the work of the OPC are detailed in Section II of this Report.
Organizational Priorities
The OPC has a single Strategic Outcome (SO 1), which is that the privacy rights of individuals be protected. Toward that end, the OPC identified three organizational priorities.
The table below describes how each organizational priority contributes to the Strategic Outcome, and what the OPC plans to do in 2012-2013 to make progress in each one. More detail on these is provided under Planning Highlights in Section II.
| Organizational Priority | Type2 | Link to Strategic Outcome | Description |
|---|---|---|---|
| 1. Fully implement new service delivery models to maximize results for Canadians. | Previously committed to | SO 1 |
The OPC compliance mandate evolves as does the nature of privacy business. Hence it is imperative to establish new processes, continuously improve service delivery and optimize the use of available resources namely through cooperation. In 2012-2013, the OPC will:
|
| 2. Provide leadership to advance the four priority privacy issues (information technology, public safety, identity integrity and protection, and genetic information) for Canadians. | Ongoing | SO 1 |
The OPC strategically focuses its activities on the four identified priority areas to derive the greatest privacy protection for Canadians from its available resources. To keep pace with the rapid evolution of privacy issues, OPC needs to maintain a reliable
knowledge foundation from which to provide leadership. In 2012-2013, the OPC will:
|
| 3. Sustain organizational capacity through continuous improvement. | Ongoing | SO 1 |
To maintain high quality, consistent service levels to Canadians in an increasingly complex environment, the Office will continue to nourish its organizational capacity through working better horizontally and managing change seamlessly. In 2012-2013, the OPC will:
|
Risk Analysis
Key risks influence the OPC’s choice of organizational priorities, affect plans and performance, and drive decision-making. The OPC continually scans its environment to remain responsive to change. This section describes the OPC’s strategic context and operating environment, outlines key risks and identifies the associated mitigation strategies.
Strategic Context and Operating Environment
Information technology innovations continue to unfold rapidly. Competitive pressures among developers to bring these innovations to market, and among organizations to adopt them quickly mean that privacy implications can often be overlooked, increasing the risk of data breach and requiring a game of “catch up” after the fact to implement features needed to protect personal information. The sheer complexity and interconnectivity of information systems, the proliferation of personal mobile devices and the new web 3.0 require highly specialized capacity and expertise for data protection authorities, such as the OPC, to keep pace with technological advances.
National security and public safety concerns continue to take priority in Canada and internationally. The increasing involvement of the private sector in assisting governments with law enforcement efforts requires an ongoing analysis of their reasonableness and effect on privacy. E-Government initiatives, once but a line item in future plans and budgets are happening here and now. The domestic and global economic situation is causing financial pressures to reduce organizational spending, which may affect investments in privacy protection. At the same time, increasing globalization and trans-border data flows continue to challenge the jurisdictional limits of individual national data protection authorities. This requires new mechanisms for sharing information between them and coordinating enforcement efforts in order to more effectively address international privacy issues.
Moving to the ever-evolving online world, individuals’ search terms and online behavioural patterns were once considered as benign, anonymous data. Today however, the increasing capacity of advertisers and website operators to collect, store and aggregate data at minimal cost is challenging our traditional concepts of what constitutes personal information and what is or is not identifiable. Further, the number of very young children online is increasing and social media has emerged as the new and preferred way of communicating among youth. These trends increase the need for effective public education and outreach so that youth, parents and educators understand the full implications of the new digital world and make informed choices.
Key Risks
Risks are continuously monitored informally while the OPC formally updates its corporate risk profile annually. Risk analysis informs corporate priority-setting and operational plans then include strategies to mitigate risks throughout the year. During 2012-2013, the OPC will pay particular attention to the challenges it will face as a result of budget restraints and the planned relocation of its main office. In that context the OPC will ensure measures are in place to make optimal use of its resources and ensure service to Canadians is not compromised. Additionally, the Office will focus on managing the following corporate risks:
Organizational Responsiveness – Risk that the organization will not be sufficiently responsive to rapid change.
Rapid evolutions in the privacy world coupled with continuously increasing workload have led the OPC to move toward more efficient, timely, innovative and responsive operations. For example, the Office is preparing to implement an online complaint process that modernizes the complaint intake and investigation process. To remain responsive in a turbulent environment, the OPC will continue investing in proactive measures such as public education, outreach and special investigations and audits on emerging issues. The Office is also committed to informing and influencing public policy through further engagement with the public, media and Parliamentary committees. As well, an integrated business and human resources plan is designed to support the organization in delivering on its mandate and meeting its business challenges.
To mitigate this risk in 2012-2013, the Office will complete the implementation of its change management strategy and accompanying tools and evaluate their effectiveness in bringing the Office to embrace change in its management practices. The Office will also evaluate and assess the business-driven training needs of the organization with the objective of building internal capacity and promoting employee excellence.
Organizational Impact of Canada’s anti-spam law – Risk that the organization will not implement its new responsibilities under Canada’s anti-spam law in a way that meets Canadians’ expectations.
The intent of the new legislation is to curb the amount of damaging and deceptive unsolicited electronic communications (spam) that circulate in Canada. Once in force, the new law will broaden the OPC’s mandate through enforcement responsibilities that are shared with the Canadian Radio-television and Telecommunications Commission and the Competition Bureau. The implementation of the law must be managed well, in light of the impact that the expanded responsibilities will have on the organization internally, as well as the external demands of working with other enforcement partners.
To mitigate this risk, the OPC will continue to collaborate with its partner institutions through various interdepartmental working groups to ensure an effective and coherent implementation process. Internally, the OPC will continue work to prepare for its new role through such things as developing investigation scenarios and operational processes. The OPC will also increase the capacity of its laboratory facilities to provide timely and relevant support to the organization in carrying-out its new responsibilities.
Meeting Service Standards – Risk that the OPC’s capacity to respond to complaints and information requests will not meet enhanced service standards in the face of increasing demands and expectations.
The OPC allocates its resources as strategically as possible in a context of increasing demands and expectations. It however remains at risk of being unable to deliver quality service in the timeframe expected by Canadians and international stakeholders. To address this risk, the OPC has introduced a number of important organizational changes to better align resources with its core functions and improve service delivery. It has also redefined its standards to meet the demand for responses to often-pressing privacy concerns and tracks and reports performance against these new service standards.
To further mitigate this risk, the OPC will continue to update and improve its complaint intake and investigation processes, through strengthening capacity building and procedures and incorporating alternative dispute resolution delivery methods where appropriate. The Office will also regularly conduct qualitative analysis of performance data to continually improve its performance against its new service standards.
Information Management (Knowledge Capital) – Risk that the OPC will not have complete or sufficient information to support effective operations and decision-making in an increasingly complex environment.
As an organization, the OPC has grown considerably over the past 10 years and the volume of its business activities continues to increase. At the same time, privacy issues have become increasingly complex, requiring integrated solutions with multiple perspectives. This demands that the Office’s increasing amount of business intelligence be managed, stored for easy access, and shared effectively within the organization. The OPC already has tools to support information management, including: a case-management system offering more integrated, easier-to-access information; Sharepoint, used as a collaboration tool; an electronic document management system; improved research databases;and other initiatives to better share information among branches, including cross-training of employees and work in horizontal teams.
However, the ever increasing volume of business activities, the inevitable turnover in staff in the highly specialized field of privacy and the interconnected privacy issues point to the need to better retain, manage and share the information on which decisions are made. To mitigate this risk, the Office will: assess the feasibility of strategies to capture and share knowledge to preserve OPC corporate memory; finalize the update to the OPC’s records management system to better support information management across the Office; develop an internal communications strategy; and design a new systematic quality control program that generates better quality and transferability of investigations data in the case management system.
Planning Summary
The following two tables summarize the total planned financial and human resources allotted to the OPC for the next three fiscal years.
| 2012-2013 | 2013-2014 | 2014-2015 | |
|---|---|---|---|
| Planned Spending | 24,606 | 24,606 | 24,606 |
| *FTE: Full-Time Equivalent. | |||
| 2012-2013 | 2013-2014 | 2014-2015 | |
|---|---|---|---|
| Planned FTEs | 176 | 176 | 176 |
Expenditure Profile
In 2012-2013, the OPC plans to spend $24.606 million to advance its three organizational priorities, meet the expected results of its Program Activities, and contribute to its Strategic Outcome.
Spending Trend from 2008-2009 to 2014-2015
The adjacent figure illustrates the OPC’s spending trend over a seven-year period.
The graph shows a slight increase in expenditures over the period of 2008-2009 to 2010-2011. The forecasted expenditures for the period of 2011-2012 reflect an increase of approximately $2 million mainly resulting from new funding for Canada’s anti-spam legislation. Subsequently the funding for 2012-2013 and beyond stabilizes at 2011-2012 levels. This, however, could change significantly due to the relocation of the main office in the fall of 2013; the increased spending would be mostly due to the office set up and equipment as well as the new technology infrastructure. Also, the spending trend does not reflect, at this time, any further reductions resulting from the OPC’s efforts to find efficiencies within its operations and use of resources.
2012-2013 Allocation of Funding by Program Activity
The figure below displays the allocation of OPC funding by Program Activity for 2012-2013. More than 40 percent of OPC funding is allocated to Program Activity 1 - Compliance Activities, which encompasses the Office’s main program delivery mechanisms: responses to information requests, complaint investigations, legal opinions, litigation proceedings, audits, and Privacy Impact Assessment reviews.
Estimates by Vote
Estimates by Vote are presented in the 2012-13 Main Estimates, which are available at the following link: http://www.tbs-sct.gc.ca/est-pre/20122013/me-bpd/docs/me-bpd-eng.pdf.
Section II: Analysis of Program Activities
Strategic Outcome
All OPC efforts and activities are directed towards achieving the organization’s single Strategic Outcome, the protection of individuals’ privacy rights. The Office plays a leadership role in encouraging organizations that handle Canadians’ personal information to respect the privacy rights of individuals. Others who contribute to this mission include provincial and territorial privacy commissioners, other national data-protection authorities, privacy advocacy groups, chief privacy officers, professional associations, consumer representatives, academics, Parliamentary committees, and federal departments and agencies.
| Expected Result | Performance Indicator | Target |
|---|---|---|
| Ultimate Outcome for Canadians | ||
| Through OPC’s leadership, Canadian federal government institutions and private-sector organizations better respect the privacy rights of individuals and better protect their personal information. | Improved privacy protection through positive change to the privacy practices of Canadian federal government institutions and private-sector organizations, as a result of OPC actions | Some improvement from the 2010-2011 baseline, representing ‘3’ on a scale of ‘1 to 5’ by March 31, 2013 |
| Performance Measurement Strategy | ||
|
This “umbrella indicator” of the influence of the OPC is measured by comparing the annual OPC performance to the 2010-2011 baseline for the following six targets:
The Office measures the influence of its actions on changes to privacy practices in Canada and reports on results in its annual Departmental Performance Report. The OPC uses the following five point scale to determine overall success with regard to the six above-listed indicators:
|
||
The OPC’s four Program Activities (compliance activities, research and policy development, public outreach, and internal services) are described in the remainder of Section II with an overview of each; a table with the expected results for Canadians, the performance indicators and targets (including measurement strategy); the allocated financial and human resources; and planning highlights for 2012-2013.
The performance measurement framework (PMF) enables the Office to supplement qualitative approaches to performance reporting with quantitative measures of progress toward expected results and the Strategic Outcome. The OPC regularly assesses the implementation of the PMF and makes adjustments as needed to ensure that indicators are measurable and provide useful information for decision-making and accountability. This Report on Plans and Priorities reflects the OPC’s revised PMF, with some new or modified expected results, performance indicators and targets.
Program Activity 1: Compliance Activities
Activity Description
The OPC is responsible for investigating privacy-related complaints and responding to inquiries from individuals and organizations. Through audits and reviews, the OPC also assesses how well organizations are complying with requirements set out in the two federal privacy laws, and provides recommendations on Privacy Impact Assessments (PIAs), pursuant to Treasury Board policy. This activity is supported by a legal team that provides specialized advice and litigation support, and a research team with senior technical and risk-assessment support. http://www.tbs-sct.gc.ca/est-pre/20122013/me-bpd/docs/me-bpd-eng.pdf
| Expected Results | Performance Indicators (Performance Measurement Strategy) | Targets (by March 31, 2013) |
|---|---|---|
| Intermediate Outcomes | ||
| Federal government institutions and private-sector organizations meet their obligations under federal privacy legislation and implement modern practices of personal information protection. | Percentage of investigation recommendations implemented within set timelines (Tracking and analysis of responses to investigation reports) |
90 percent |
| Percentage of audit recommendations fully implemented two years after publication of the final audit report (Tracking and analysis of responses to audit reports) |
75 percent | |
| Immediate Outcomes | ||
| Individuals receive timely and effective responses to their inquiries and complaints. | Percentage of information requests responded to within established service standards (Tracking and analysis of Office statistics on turnaround time) |
90 percent |
| Percentage of complaints resolved through early-resolution strategies, where no formal investigation is commenced (Tracking and analysis of the disposition of complaints) |
20 percent | |
| Percentage of complaints responded to within 12 months of acceptance (Tracking and analysis of Office statistics on response time for complaints) |
95 percent | |
| Federal government institutions and private-sector organizations receive advice and recommendations to improve their privacy practices, in compliance with federal privacy legislation and policies. | Percentage of PIA consultations/ recommendations that result in an added privacy protection for government programs/initiatives (Tracking and analysis of the privacy outcome from the PIA consultations/ recommendations) |
75 percent |
| Percentage of audits completed within planned timelines (Tracking and analysis of time allotted to audits compared to planned times) |
90 percent | |
| Percentage of PIA reviews completed within 120 days of receipt (Tracking and analysis of time allotted to PIA reviews against standard) |
70 percent | |
| Forecast Spending 2011-2012 |
Planned Spending | |||
|---|---|---|---|---|
| 2012-2013 | 2013-2014 | 2014-2015 | ||
| Financial Resources ($000) | 10,391 | 10,366 | 10,366 | 10,366 |
| Planned Human Resources (FTEs) | 87 | 87 | 87 | |
Planning Highlights for Program Activity 1
While continuing to work toward the Compliance Activities outcomes (as identified in the above outcomes table) through its usual ongoing activities, the OPC will focus on the following initiatives in 2012-2013 and beyond to deliver on the organizational priorities and associated key commitments (presented in Section I):
- Update and strengthen the organization’s complaint intake and investigation processes, with a view to providing service to Canadians in a more efficient and effective manner, namely through strengthening capacity building and procedures, implementing early resolution of complaints, efficiently using resources in the Toronto office, and incorporating alternative dispute resolution delivery methods, where appropriate;
- Improve the capability of the case management system through a business process review, and develop new reporting tools to track performance (e.g. a dashboard report);
- Enhance the Office’s technological support capacity through a larger team of technologists and an expanded state-of-the-art testing laboratory;
- Implement a new systematic quality control program to improve the quality and transferability of data and knowledge created in the course of investigations;
- Put in place processes and systems enabling the OPC to deliver service to Canadians as required under Canada’s anti-spam legislation and recent amendments to PIPEDA;
- Implement new processes and procedures to coordinate and share information, and to perform joint or collaborative investigations with provincial/territorial and international data protection agencies;
- Conduct public sector audits examining access controls and carry out follow-up to audits of federal personal information disposal practices, the protection of personal information in the face of wireless technology, and the privacy practices of a national retailer;
- Select reviews of Privacy Impact Assessments (PIAs) using a triage method that gives priority to compliance-related issues pertaining to the OPC’s priority privacy issues;
- Deliver a PIA case study workshop to federal government institutions, offering practical, hands-on guidance on how to approach the conduct of PIAs and assess risks to privacy.
Program Activity 2: Research and Policy Development
Activity Description
The OPC serves as a centre of expertise on emerging privacy issues in Canada and abroad by researching trends and technological developments, monitoring legislative and regulatory initiatives, providing legal, policy and technical analyses on key issues, and developing policy positions that advance the protection of privacy rights. An important part of the work involves supporting the Commissioner and senior officials in providing advice to Parliament on potential privacy implications of proposed legislation, government programs, and private-sector initiatives. http://www.tbs-sct.gc.ca/est-pre/20122013/me-bpd/docs/me-bpd-eng.pdf
| Expected Results | Performance Indicators (Performance Measurement Strategy) | Targets (by March 31, 2013) |
|---|---|---|
| Intermediate Outcomes | ||
| Public- and private-sector stakeholders are enabled to develop policies and initiatives that respect privacy rights. | Percentage of positive feedback from stakeholders about the usefulness of OPC policy guidance (Tracking and analysis of stakeholders’ feedback to OPC’s policy guidance via an electronic survey) |
70 percent |
| Immediate Outcomes | ||
| Parliamentarians are able to draw on OPC expertise to identify and address privacy issues. | Percentage of bills and issues with a high or medium relevance to privacy that receive the OPC’s views in the course of the legislative process (Tracking of statistics on high and medium privacy-relevant bills and issues: total number on which the OPC gave its views, either through Parliamentary committee appearances, submissions or letter) |
75 percent |
| Knowledge about privacy issues is advanced. | Increased take-up of OPC research (Statistics on the number of website visits to OPC research papers or their URL links) |
Annual increase relative to previous year |
| Forecast Spending 2011-12 |
Planned Spending | |||
|---|---|---|---|---|
| 2012-13 | 2013-14 | 2014-15 | ||
| Financial Resources ($000) | 5,206 | 5,195 | 5,195 | 5,195 |
| Planned Human Resources (FTEs) | 19 | 19 | 19 | |
Planning Highlights for Program Activity 2
While continuing to work toward the Research and Policy Development outcomes (as identified in the above outcomes table) through its usual ongoing activities, the OPC will focus on the following initiatives in 2012-2013 to deliver on the organizational priorities and associated key commitments (presented in Section I):
- Provide timely assessments of emerging technologies through laboratory testing as well as additional knowledge obtained by leveraging relationships with other data protection authorities;
- Develop policy positions with respect to the upcoming, legislatively-mandated Parliamentary review of PIPEDA;
- Implement a new strategic re-orientation of the OPC Contribution Program with greater emphasis on enabling the uptake and application of research results by relevant end-users;
- Continue to play a leadership role in advising the Organisation for Economic Co-operation and Development (OECD) on possible revisions to its Guidelines on the Protection of Privacy and Transborder Flows of Personal Data;
- Develop and publish policy guidance for public- and private-sector organisations, including best practices for protecting privacy in the new “app economy”.
Program Activity 3: Public Outreach
Activity Description
The OPC delivers public education and communications activities, including speaking engagements and special events, media relations, and the production and distribution of promotional and educational material. Through public outreach activities, individuals are informed about privacy and personal data protection, enabling them to protect themselves and exercise their rights. The activities also allow organizations to understand their obligations under federal privacy legislation. http://www.tbs-sct.gc.ca/est-pre/20122013/me-bpd/docs/me-bpd-eng.pdf
| Expected Results | Performance Indicators (Performance Measurement Strategy) | Targets (by March 31, 2013) |
|---|---|---|
| Federal government institutions and private-sector organizations better understand their obligations under federal privacy legislation and individuals better understand their rights. | Percentage of participants in the annual OPC PIA workshop who feel they acquired a better understanding of the requirement to assess privacy risks of federal programs (Analysis of results from electronic survey of participants to the OPC annual PIA workshop organized) |
75 percent |
| Percentage of private-sector organizations that are moderately or highly aware of their obligations under federal privacy legislation (Analysis of results from biennial polling of private industry) |
85 percent | |
| Percentage of Canadians who feel they know about their privacy rights (Analysis of results from biennial public opinion poll) |
20 percent | |
| Immediate Outcomes | ||
| Individuals have access to relevant and timely information to protect their privacy rights. | Annual increase in website visits (Tracking and analysis of statistics on web site traffic) |
Visits to OPC websites increase year over year |
| Federal government institutions and private-sector organizations have access to useful information about their privacy responsibilities. | Reach of target audiences with public education initiatives (Comparison between ‘intended’ reach with public education initiatives and ‘actual’ reach) |
70 percent |
| Forecast Spending 2011-12 |
Planned Spending | |||
|---|---|---|---|---|
| 2012-13 | 2013-14 | 2014-15 | ||
| Financial Resources ($000) | 3,976 | 3,969 | 3,969 | 3,969 |
| Planned Human Resources (FTEs) | 24 | 24 | 24 | |
Planning Highlights for Program Activity 3
While continuing to work toward the Public Outreach outcomes (as identified in the above outcomes table) through its usual ongoing activities, the OPC will focus on the following initiatives in 2012-2013 to deliver on the organizational priorities and associated key commitments (presented in Section I):
- Develop a better understanding of Canadians’ views of privacy, particularly in the online environment;
- Develop and/or implement communication strategies and efforts to fulfil the Office’s new responsibilities under Canada’s anti-spam legislation and provide guidance to individuals and organizations on how to protect their privacy and personal information in the face of related cyber threats;
- Participate in events that provide OPC technologists with a forum to educate participants on privacy issues related to a specific industry or sector;
- Contribute to public dialogue on policy and legislative initiatives affecting privacy, namely through publishing articles and conducting media outreach, to broaden the public’s perspective on matters relating to the four priority privacy issues of information technology, public safety, identity integrity and protection, and genetic information;
- Focus communication efforts on youth and their parents and educators, seniors and new Canadians among individuals, and small- and medium-sized enterprises, while also informing federal departments and agencies and other federally-regulated organizations;
- Broaden the range of the Office’s youth outreach activities by promoting newly created tools to equip educators of children in grades four through 12 with useful information and guidance about protecting personal information and privacy online, while also continuing interaction with the OPC’s youth advisory panel;
- Launch and promote a graphic novel designed to engage youth about online privacy in a new and innovative way;
- Expand the scope of the outreach activities targeted to industries from the private-sector to further improve compliance with PIPEDA.
Program Activity 4: Internal Services
Activity Description
Internal Services are groups of related activities and resources that support the needs of programs and other corporate obligations of an organization. As a small entity, the OPC’s internal services include two sub-activities: governance and management support, and resource management services (which also incorporate asset management services). Communications services are not included in Internal Services but rather form part of Program Activity 3 – Public Outreach. Similarly, legal services are not included in Internal Services at OPC, but are covered under Program Activity 1 – Compliance Activities, and Program Activity 2 – Research and Policy Development. http://www.tbs-sct.gc.ca/est-pre/20122013/me-bpd/docs/me-bpd-eng.pdf
| Expected Results | Performance Indicators (Performance Measurement Strategy) |
Targets (by March 31, 2013) |
|---|---|---|
| The OPC achieves a standard of organizational excellence, and managers and staff apply sound business management practices. | Percentage of the Management Accountability Framework (MAF) areas rated strong or acceptable (Review of results from the biennial MAF self-assessment exercise and annual progress reports) |
70 percent |
| Forecast Spending 2011-12 |
Planned Spending | |||
|---|---|---|---|---|
| 2012-13 | 2013-14 | 2014-15 | ||
| Financial Resources ($000) | 5,086 | 5,076 | 5,076 | 5,076 |
| Planned Human Resources (FTEs) | 46 | 46 | 46 | |
Planning Highlights for Program Activity 4
The OPC will continue to work toward achieving and maintaining a standard of organizational excellence and have managers and employees apply sound business management practices. Over the next three years, and more particularly in 2012-2013, the OPC will sustain the organizational capacity through continuous improvement (its third organizational priority) by pursuing the following Internal Services activities, in addition to its usual ongoing activities:
- Build a changeable organization through a review of compliance functions (investigations, privacy impact assessments, audits) in relation to service demand to determine the adequacy of resourcing to meet requirements;
- Embed a uniform approach to all initiatives involving significant change through the roll-out and integration of the OPC’s change-management strategy and accompanying tools;
- Complete integration of recent changes to the Office’s organizational design to institute newly mandated responsibilities (e.g. Canada’s anti-spam legislation) and service improvements, notably the redesigned Information Centre;
- Review, evaluate and assess business-driven training needs to explore the development of a unique OPC curriculum for training, and further refine the talent management program launched in 2011-2012;
- Implement a revised and streamlined suite of human resource policy instruments, processes and tools that support OPC priorities and align with government-wide initiatives such as Common Human Resources Business Processes and Administrative Services Review;
- Enhance collaboration, reduce duplication of efforts and facilitate knowledge-transfer between staff through:
- the continued development of Sharepoint sites to post documents of common interest, particularly for horizontal initiatives;
- the “privacy conversations” series which seeks to encourage internal dialogue between OPC staff and specialized experts on topical issues;
- a new concerted effort to improve the internal dissemination of research results from the OPC Contribution Program and information from the triage of PIAs based on the four priority privacy issues;
- Encourage increased information exchanges resulting from participation in internal working groups on the four priority privacy issues and other ad hoc groups established to examine particular issues, regular inter-branch dialogue (such as biweekly Policy and PIA meetings), internal legal training sessions for investigators and information officers and internal policy workshops
- Introduce the ability to more efficiently respond to public information requests electronically in addition to mail, facsimile and telephone;
- Broaden the utilisation of database software to enable faster production of communication materials and more timely response to public and media information requests;
- Expand the use of the newly developed subject taxonomy for improved standardization of terminology throughout the OPC;
- Increase capacity of laboratory facilities to provide timely, relevant results in meeting anticipated demand brought on by the introduction of Canada’s anti-spam legislation and the overall increase of technology-related privacy issues.
Section III: Supplementary Information
Financial Highlights
The future-oriented financial highlights presented in this Report on Plans and Priorities offer an overview of the Office's financial position and operations. These financial highlights are prepared on an accrual basis to strengthen accountability and improve transparency and financial management.
| $ Change | Future-Oriented 2012-13 |
Future-Oriented 2011-12 |
|
|---|---|---|---|
| Total Expenses | -2,466 | 26,056 | 28,522 |
| Net Cost of Operations | -2,466 | 26,056 | 28,522 |
| $ Change | Future-Oriented 2012-13 |
Future-Oriented 2011-12 |
|
|---|---|---|---|
| Total assets | -83 | 4,199 | 4,282 |
| Total liabilities | -1,189 | 4,172 | 5,361 |
| Equity | -1,106 | 27 | (1,079) |
| Total | -83 | 4,199 | 4,282 |
Future-oriented financial statements
The OPC future-oriented financial statements can be found at: http://www.priv.gc.ca/information/02_05_e_e.cfm#fofs.
Supplementary Information Tables
The following tables can be found on the Treasury Board of Canada Secretariat's web site :
- Upcoming Internal Audits;
- Summary of Capital Spending by Program Activity; and
- Greening Operations.
Section IV: Other Items of Interest
Legislation Administered by the Privacy Commissioner
| Privacy Act | R.S.C. 1985, ch. P21, amended 1997, c.20, s. 55 |
| Personal Information Protection and Electronic Documents Act | 2000, c.5 |
Statutory Annual Reports, other Publications and Information
For further information about the OPC and available resources, please visit the OPC website at http://www.priv.gc.ca/index_e.cfm or contact the Office toll-free at: 1-800-282-1376.
1 Reference is made to “individuals” in accordance with the legislation.
2 “Type” is defined as previously committed to (committed to in the first or second fiscal year prior to this RPP); ongoing (committed to at least three fiscal years prior to this RPP), or new (committed to in this RPP). Some priorities defined as previously committed to or ongoing may include refinements from their original wording.