In a recent letter to the Standing Committee on Access to Information, Privacy and Ethics, Daniel Therrien, the Privacy Commissioner of Canada, suggested that a 90% increase in funding for the Office of the Privacy Commissioner (OPC) was required to have a “true impact in protecting Canadians’ privacy rights”.
OPC receives $25 million already
The OPC’s current funding is approximately $25 million per year. The Commissioner considered a $23 million increase to be “realistic”. However, the Commissioner added that it had only sought a more “modest” $8 million increase, which represented a 30% increase to permanent funding. The Commissioner cited “rapidly evolving privacy threats” for the budgetary increases and noted that a 90% increase in funding would be in-line with increases to the UK Information Commissioner’s Office.
What a 90% increase buys
The Commissioner argues that a 30% increase would allow for a “limited number of proactive promotion and compliance activities”. The backlog of existing complaints would be “reduced” but not eliminated.
However, with a 90% increase, the Commissioner says that the OPC could provide more advisory services to businesses than it does at present. The increase in funding would also be used to engage in “targeted advertising to bring individuals to our site when they are about to make a decision on whether to disclose their personal information.” Backlogs could be reduced and more proactive activities could be undertaken.
Is a 90% increase necessary?
One of the justifications for a 90% increase is the desire to provide more advisory services. However, the OPC has not demonstrated that it has explored available options to work with stakeholders when developing guidance. The Personal Information Protection and Electronic Documents Act (PIPEDA) was borne out of a voluntary industry code. Quite literally, the main substantive protections in PIPEDA are in Schedule 1 to the legislation, which was that industry code. Arguably, PIPEDA has stood the test of time precisely because the provisions of Schedule 1 were developed by industry stakeholders with an understanding of the operational impacts of the provisions they were drafting.
The OPC could take a lesson from that success. The OPC could increase the use of working groups of stakeholders to draft guidance on important topics. This shared responsibility model would have the benefit of developing industry and consumer group buy-in. It would also shift the expense of developing that advisory guidance to stakeholders. It would be more likely to produce guidance that is relevant and attuned to operational realities.
The OPC also wants money for advertising. In particular, the OPC wants to “use contextual advertising to bring individuals to [the OPC’s] site when they are about to make a decision on whether to disclose their personal information”. There is a certain irony in the OPC wanting to engage in targeted online advertising of individuals when the OPC has been so hostile to the interest-based advertising industry.
The fact that the OPC feels the need to engage in this type of advertising is an indictment of its resistance to developing model privacy notices. The OPC missed an opportunity during the consultations on consent to modernize and standardize how disclosures are made.
The OPC could have identified types and uses of data that a reasonable person would expect when engaging in online activities. Disclosures regarding these uses could have been done in a short-form manner and only those uses falling outside of these categories would need to be highlighted.
In exchange for using the short-form disclosure, the organization could have been required to link back to educational material at the OPC website. While large, international organizations may not have adopted this approach due to potential operational complexities, this would have solved a problem for numerous small and medium-sized enterprises.
No, the OPC does not need a 90% increase in funding. It needs to work more creatively with industry.
Check out Commissioner Therrien’s letter here.
Categories: Office of the Privacy Commissioner of Canada, Privacy