Office Of The Privacy Commissioner Of Canada Tables 2021-2022 Annual Report, Highlighting A Year Of Privacy Initiatives And The Way Forward For Legal Reform

On September 29, 2022, the Office of the Privacy Commissioner of Canada (the OPC) tabled its 2021-2022 Annual Report to Parliament (the Annual Report) on the Privacy Act and Personal Information Protection and Electronic Documents Act (PIPEDA).  The Annual Report provides an overview of the work done by the OPC during the last year.

Among the statistics shared in the Annual Report, the OPC highlighted the data breach reporting habits of public and private sector organizations during 2021-2022.  The OPC saw a 65% increase in breach reports from public sector institutions compared to the previous year.  The majority of the reports came from two public organizations, with most organizations subject to the Privacy Act not reporting any breaches in the last year.  Although this may seem encouraging, the OPC highlighted its concern regarding under-reporting in the public sector and it once again called for privacy breach reporting to be mandatory under the Privacy Act. This concern regarding under-reporting continued in the private sector statistics, with the OPC finding a 17.5% decrease in data breach reports received over the previous year, despite the mass transition of Canadian organizations to work-from-home arrangements which increase privacy risks. 

The Annual Report also summarized several privacy issues investigated by the OPC in the past year. Of note, the OPC dealt with issues relating to pandemic measures, law enforcement’s use of facial recognition technology, the location tracking of Tim Hortons' customers, and the 24-hour surveillance of employee drivers in the trucking industry. The OPC noted that these investigations demonstrate how the privacy of Canadians may be affected in a number of ways by today’s technology, and emphasized why it is important to have modern statutory mechanisms that address these novel issues.

The OPC described its optimism towards Canada’s newly proposed privacy legislation.  The OPC sees the private sector Bill C-27, The Digital Charter Implementation Act, 2022, as a step towards a hopeful future under a modern privacy regime.  The OPC is already working on a transition plan to ensure efficient implementation of the new framework, which includes cost and growth modelling and preparations for its new responsibilities (such as new order-making powers, adjudicatory functions, and obligations to review applications for codes of practice and certification programs).  The Annual Report also references the remarks made by the Minister of Justice, the Honourable David Lametti, that promises public sector privacy reform is not far behind Bill C-27.

Summary By: Imtiaz Karamat