Thank you very much, Mr. Chair.
Ladies and gentlemen of the committee, thank you for the opportunity to appear before you to discuss the 2017-18 Main Estimates.
In the time allocated, I will first discuss the sustained demands on our office and the management of our financial resources. Secondly, I will talk about our policy agenda for this coming year.
In recent years, the Office of the Privacy Commissioner of Canada has maintained its efforts to find efficiencies and make optimal use of existing resources of slightly more than $24 million to be as effective as possible in addressing the privacy risks of an increasingly technological world.
Fiscal year 2017-18 will be no exception. Amidst competing demands, we will not lose sight of our mandate: ensuring that the privacy rights of Canadians are respected and that their personal information is protected.
In 2017-18, we will continue to fulfill our core mandate, which includes conducting investigations, examining breach reports, undertaking audits, reviewing privacy impact assessments or PIAs, providing guidance to individuals and organizations, and offering advice to parliamentarians.
On the investigations side, we have become more efficient in part through increased use of early resolution to find appropriate solutions. In 2015-16, 38% of complaints were resolved in this manner under the Privacy Act and 50% under the Personal Information Protection and Electronic Documents Act or PIPEDA. As a result, our response time on average was seven months for both public-sector and private-sector complaints.
However, the number of complex files is growing, which is creating a backlog of complaints that are not resolved after 12 months. In the coming year, I intend to devote temporary resources to address this situation.
In 2015-16, we received 88 new PIAs and completed 73 PIA reviews, in addition to opening 13 new consultation files. As you know, we would like to receive more PIAs and draft information sharing agreements, as we believe reviewing programs upstream is a good way to mitigate privacy risks.
In addition, we are taking steps to prepare for the coming into force of the breach provisions of Bill . These new provisions will require private-sector organizations to report certain breaches to my office.
Public education and outreach are important activities to ensure Canadians are empowered to exercise their privacy rights and organizations are able to comply with their obligations. Last year, we revamped our website both in its structure and content to make it more user-friendly. This year, we will continue to update its content to provide helpful advice to Canadians.
We will continue to offer guidance to specific industry sectors deemed to be in need of greater privacy awareness, as well as vulnerable groups such as youth and seniors. We will also provide new guidance for individuals, and we will continue to advance our privacy priorities on issues such as online reputation, the body as personal information, the economics of personal information, and government surveillance.
Despite these efforts, we need to do much more to ensure that privacy rights are truly respected, a key condition for consumer trust and growth in the digital economy. Our goal is to complete all investigations within a reasonable time, to engage in some proactive enforcement, to give proactive advice to government, and to issue research-based guidance on most current and upcoming privacy issues.
In my annual report to be tabled in September, which will include our conclusions on improvements to the consent model and recommendations to amend PIPEDA, I will be able to bring more specificity to our compliance and proactive strategies. This, in turn, will inform a discussion on what might be an appropriate level of investment in OPC activities for the next few years.
I will now turn to some of the policy issues that we're seized with.
First is consent. Last May, my office released a discussion paper on issues related to privacy and consent. We then, through an extensive consultation process, sought input from industry, privacy experts, and Canadians. As mentioned, our final report will be released in September, and we will then work to implement the chosen solutions.
Second is online reputation. My office has also launched a consultation and call for submissions on the issue of online reputation as part of our efforts to address one of our strategic privacy priorities: reputation and privacy. We will share our policy position on online reputation before the end of the calendar year.
Third is legislative reform. My office has long stressed the need to modernize Canada's legal and regulatory frameworks. While the introduction of Bill was a positive development, Canada's federal private sector privacy law is now more than 15 years old. Technology and business models have changed. Our work on both consent and reputation will help inform the recommendations we will make to Parliament on reforming the law.
On the public sector side, I would like to express my gratitude to members of this committee for supporting my office's recommendations for modernizing the Privacy Act. My office now looks forward to participating in the government's review of the act to ensure that it meets the needs and expectations of Canadians, and in our view this work should proceed without delay.
On government surveillance, issues related to government surveillance will also form an important part of our policy agenda in the coming year. We note your recent report on SCISA, and we thank you for it. We also note the report just made public by SECU, the committee on national security, which also touched on information sharing under SCISA. We now await the measures the government will put forward to modify Bill to ensure that Canada's national security framework protects Canadians and their privacy.
We also have a number of investigations related to national security and government surveillance, and we are seeing heightened concerns from Canadians about privacy protections at the border and in the United States. Further to the adoption by President Trump of executive order 13768 of January 25, which deals with security in the interior of the United States, I had written to ministers to ask for confirmation that administrative agreements previously reached between Canada and the U.S. will continue to offer privacy protection to Canadians in the United States. Upon receipt of the government's response, which I expect shortly, I will inform Canadians of my conclusions.
In closing, to face the sustained volume but increased complexity of our work, we will continue this year to make the most efficient use of our resources as we have tried to do in the past.
Thank you, Mr. Chair. I look forward to questions from the committee.
Simply to describe what is the impact of that order, that order is an executive order that does not change U.S. law. It's an executive order by the President of the United States. It says to U.S. officials that, to the extent that privacy protections of a discretionary administrative but not legal nature were offered to non-U.S. citizens previously, these protections are at the very least at risk. Canadians who until then, and perhaps now—we'll see what ministers say in response to my letter—had certain administrative protections under, say, the Five Eyes alliance, such that those countries do not spy on one another's citizens. That's not a legal instrument, but an administrative agreement that provides certain administrative protections to Canadians. Certain border arrangements, also of an administrative nature, provide certain privacy protections to Canadians.
The executive order can be read as saying these discretionary protections for non-U.S. citizens no longer apply. The order is ambiguous. It can have that impact. I have written to three Canadian ministers so that they can determine through conversations with their U.S. counterparts how the U.S. administration will actually apply this order. I'm simply saying there's a risk here. I've asked the Canadian government to verify how the U.S. administration will apply the order. Will it reduce the privacy protections of Canadians in the U.S.? I'm told that within a few weeks I will have an answer to my query to the Canadian government.
I'll receive an answer from the Canadian government, and then I'll have to assess what the effect of that order is exactly, and I'll need to inform Canadians—I feel I need to inform Canadians—of what the effect of the order is on their level of privacy protection in the U.S., for instance, when they appear at the U.S. border, or when they use electronic means of communications where their data may go through the U.S. in going to a merchant, a colleague, a friend, etc.
In terms of resources, we will give advice to Canadians on what we think the consequences of the order are. I think that's an important activity to undertake. I don't think it will be hugely expensive. The issue is to determine what is in fact the impact of that order on the protections to privacy of Canadians in the U.S.
Thank you very much for the opportunity to discuss the main estimates for the Office of the Information Commissioner of Canada.
The Access to Information Act establishes the Office of the Information Commissioner as the first level of independent review of institutions' handling of access to information requests. I am required by law to investigate all complaints within my jurisdiction. These investigations are conducted in an efficient, fair, and confidential manner.
My office receives two kinds of complaints. Administrative complaints relate to matters such as delays in responding to requests. Refusal complaints relate to matters such as the application of exemptions used to withhold information.
The fiscal year that just closed was one of significant activity for the Office of the Information Commissioner of Canada. On the investigations front, the main areas of focus were the implementation of a simplified investigation process, with supporting advisory notices; the roll-out of interest-based negotiation and mediation for investigations; and putting into operation the special allotment funding received as part of last year's Supplementary Estimates B. I appeared before this committee in November on those supplementary estimates and would again like to thank this committee for supporting my request for additional funding.
This year, the overall main estimates for my office are $11.2 million, including employee benefit plans. The main estimates allotment for 2017-18 is in line with amounts received in previous years without the special purpose allotment. Given the number of complaints we receive, this amount is not sufficient to carry out the mandate of the Office of the Information Commissioner and to serve Canadians adequately.
Let me elaborate.
The number of requests made under the Access to Information Act has been increasing every year, as have complaints to the Office of the Information Commissioner. In 2010-11, when I became information commissioner, the government received approximately 41,000 requests. Last year, the government received 75,000. This is an 81% increase.
For the past two years, the office has received over 2,000 complaints per year. In addition to the continuous rise in complaints, there are other factors and risks that must be taken into account when forecasting our workload for the upcoming year. These include an anticipated surge in complaints related to Phoenix pay issues and the declining performance of institutions.
The inventory of complaints remains an issue for the office. In this past year, with the addition of the temporary funding the office resolved 2,245 complaints; however, the total number of open complaints at the close of the year still stood at more than 2,800, a reduction from the beginning of the fiscal year but nonetheless quite a significant number. This number will undoubtedly grow, under the current resource levels.
Without additional funding, the OIC does not have the capacity to absorb the expected increase in complaints and related workload. This is especially problematic as I continue to see complaints that demonstrate a culture of delay across the system and of exemptions applied in an overbroad manner.
I have put in place a plan to continue to safeguard the right of access under these circumstances. This is especially important given that the Office of the Information Commissioner will soon be in a period of transition as my mandate comes to an end. This plan will ensure corporate stability and transfer of knowledge.
For the coming year, I have the following key priorities.
First, we will continue to capitalize on the momentum gained last year as part of our simplified investigation process and interest-based negotiation. We will also continue to review the inventory of complaints to develop strategies for grouping complaints by subject matter or institution to maximize efficiencies. For example, we began a strategy last year that deals with complaints against Canada Post.
Second, we will leverage IT tools to enhance efficiencies. Examples of these tools include an online complaint form, optical character recognition software to ease searching through voluminous records, and the use of dashboards for investigation and litigation files.
Third, we will continue to hold the government to account on its promise to be open by default, and particularly to amend the Access to Information Act. I note that the government was recently elected to the steering committee of the Open Government Partnership. I'm hopeful that this will encourage the government to lead by example and take bold action on openness and transparency, including transforming the outdated Access to Information Act into a model law for other countries to follow.
Finally, I am in discussions with the government for another round of supplemental funding so that the successes of 2016-17 will not be lost in the year to come.
Fiscal year 2017-18 is shaping up to be one of change and challenge. Additional funding is necessary so the office can meet the challenges that are coming. However, if supplementary funding is not forthcoming, I know the Office of the Information Commissioner will do its best to provide exemplary service to Canadians under the current resourcing levels.
Thank you, Mr. Chair.
We are ready to answer your questions.
We got around $3 million. The objective we had to fulfill was to close 2,361 files. By March 31 we had closed 2,245—a gap of 116.
We haven't finished all of the calculations, because the fiscal year is not quite closed, but we're looking at a lapse of about $400,000 out of the $3 million that we were not able to spend and that will go back into the system. As of today, we have closed an additional 113 files.
We achieved 95% of our results by March 31, even though we received the funding extremely late. It was extremely labour intensive, I must say, to manage all that—the extra volume, those extra files, the extra funding, the extra hiring, the extra managing, the training, and so on.
We had a very busy year, so we were a little bit short on the total. We were able to keep some of the consultants, and now we're three short, four weeks after.
Regarding the institutions, the 2015-16 data indicate that there really was a decrease in their performance as to disclosure in 30 days, that is to say the number of files for which a reply was provided in 30 days. That drop was not very big, but there was one. We did, in parallel, see an increase of 10% in complaints regarding delays. We can't predict the number of complaints. However, we do this analysis to get a sense of what is coming. That would be a partial answer to your question.
Another part of the answer concerns the files, that is the access to information requests where all of the documents were disclosed without redaction. That number also decreased. Among the most important institutions, we observed that some were experiencing difficulties. In the course of the year we will have to work with them as much as possible, because we noted that there really are some issues. These institutions are really in trouble, and that will have an effect on general performance. They are large departments: National Defence, RCMP, Health Canada, Transport Canada, and others.
Regarding Canada Post, that is a particular situation. The Federal Accountability Act came into effect in 2006-07. There is a provision in that act that applies to Canada Post only. There was also one for CBC/Radio-Canada. In the end, to process CBC/Radio-Canada files, we had to go to Federal Court to obtain an interpretation of that provision.
We are working on the files with Canada Post. Without an interpretation of that provision of the act, both we and Canada Post have trouble processing the disclosure of files. In light of that situation, we decided to work on the files in a particular and organized manner. This will allow us to arrive at an agreement, or a decision from the Federal Court if that proves necessary.
Yes, I can see that. That's obviously in your recommendations overall, to open that up.
I'll just give you my own edification here as well. We put in a couple of requests, not too many, to the in August. We received the information in February. The information we received was disgraceful, as far as I'm concerned, for the honest questions that we asked. Again, it's a lot of excuses, but if it could be more open, for me, or if you have the ability to kick the tires and see, it would be much more reasonable.
Now, in regard to that one item of cabinet confidentiality, if this actually happened, how would you, or I guess your successor, peg that in terms of a budgetary item as far as extra staffing is concerned? Would that be four or five people, for instance, doing that full time?
First of all, I did make it clear to the government that if it needs me to stay until it finds someone else, I'm prepared to do that, so that's fine. I'm expecting that will happen, so I think we're looking at that being until at least December. The notice for my position has not been posted yet, but I'm expecting it to be planned soon. Essentially I think the situation is that we have a few months ahead of us.
Second, the OIC is now, I would say, a very stable organization. As I said, when I arrived, we had no Internet; we had no financial systems; we had none of this governance in place. Now all of that is in place, so that's very stable. The senior management team, under Layla Michaud, has been there for several years now, along with my senior counsel, who couldn't be here today, so that's very well anchored.
Now we are doing a couple of things to ensure ongoing stability in terms of investigations. One thing I had delayed doing, because I was waiting for amendments, was a code of procedure for the investigative function, which would act as an anchor for the organization, but also for institutions dealing with our offices. It would provide some streamlining of the investigative process and anchor all the blocks that we've built over the years into one single document for the OIC and for the institutions.