IPC - Information and Privacy Commissioner of Ontario

2022
ANNUAL REPORT

Commissioner’s message

Throughout my career, I have had the honour of working with different regulators who shoulder great responsibility for ensuring compliance with privacy and access laws in a rapidly evolving digital world. I have also worked with public institutions who must implement requirements in the real world, as well as astute practitioners who have a very practical sense of the opportunities and challenges at play, academics who have devoted their careers to advancing knowledge in this critical field, and dedicated civil society groups who play such a vital role in advancing access and privacy rights for the benefit of us all.

This broad experience has taught me to listen to and appreciate the many diverse perspectives that come to bear on the complex issues we deal with. It has instilled a sense of humility with which I approach my work and a natural inclination to consult and collaborate with others to reach pragmatic solutions with beneficial impacts.

This is why, when I began my mandate as Information and Privacy Commissioner of Ontario, I came with a vision of a modern and effective regulator dedicated to supporting compliance and promoting public trust in our public institutions.

READ THE COMMISSIONER'S FULL MESSAGE

"This broad experience has taught me to listen to and appreciate the many diverse perspectives that come to bear on the complex issues we deal with. It has instilled a sense of humility with which I approach my work and a natural inclination to consult and collaborate with others to reach pragmatic solutions with beneficial impacts.

IPC VISION

To be a modern and effective regulator with real-world impact

MISSION

enhance Ontarians’ trust that their privacy and access rights will be respected by:

GOALS

Proactively advancing their rights in key strategic areas that impact their lives

Advance Ontarians’ privacy and transparency rights in a modern government by working with public institutions to develop bedrock principles and comprehensive governance frameworks for the responsible and accountable deployment of digital technologies.
Champion the access and privacy rights of Ontario’s children and youth by promoting their digital literacy and the expansion of their digital rights while holding institutions accountable for protecting the children and youth they serve.
Contribute to building public trust in next-generation law enforcement by working with relevant partners to develop necessary guardrails for the adoption of new technologies and community-based approaches that protect both public safety and Ontarians’ access and privacy rights.
Promote confidence in digital health by guiding custodians to respect the privacy and access rights of Ontarians, and supporting the pioneering use of personal health information for research and analytics to the extent it serves the public good.

Addressing complaints and appeals in a fair, timely and meaningful manner

Provide timely resolution to Ontarians’ access appeals and privacy complaints by defining and upholding applicable service standards.
Issue concise and plain language decisions that are fair and meaningful to the parties and support compliance with the law.
Support understanding of the law and participation in the IPC appeals process by publishing actionable guidance based on trends and lessons learned from individual cases.

Maintaining their confidence in the organizational excellence of the IPC

Transform the IPC into a digitally friendly organization by delivering services more effectively and efficiently online, while improving user experience.
Build the IPC into an employer of choice by attracting and retaining high quality talent and developing a positive corporate culture through enhanced employee programs and engagement.
Strengthen IPC governance and accountability through modern controllership best practices and prudent fiscal management.

CROSS-CUTTING STRATEGIES

We will consider accessibility and equity issues to help reduce disparate outcomes for marginalized communities.
We will strive to be consultative and collaborative with relevant partners and stakeholders.
We will develop the knowledge, skills, and capacity needed, both internally and externally, to advance IPC’s goals.
We will be bold and aspirational in our vision, but also stay grounded in pragmatism.

VALUES

Respect

We treat all people with respect and dignity, and value diversity and inclusiveness.

Integrity

We take accountability for our actions and embrace transparency to empower public scrutiny.

Fairness

We make decisions that are impartial and independent, based on the law, using fair and transparent procedures.

Collaboration

We work constructively with our colleagues and stakeholders to give advice that is practical and effective.

Excellence

We strive to achieve the highest professional standards in quality of work and delivery of services in a timely and efficient manner.

ADVOCACY

Proactively advancing Ontarians' rights in key strategic areas that impact their lives

Privacy and transparency in a modern government

The transparency challenge

On International Right to Know Day 2022, the IPC launched a Transparency Challenge, calling on public institutions subject to the Freedom of Information and Protection of Privacy Act (FIPPA) and the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) to share their innovative programs that improve government transparency for the benefit of Ontarians.

Privacy and Transparency in a Modern Government

FPT digital ID resolution

Proposals for digital identity or other forms of digital credentials are emerging in Canada and around the world to make it easier for individuals, businesses, and governments to confirm identity information and conduct online transactions more seamlessly and efficiently.

Trustworthy AI frameworks

Rapid developments in artificial intelligence (AI) offer tremendous opportunities to address many of society’s most complex problems across all sectors of society. AI technologies can be used to fast-track the delivery of government services, solve major public health issues, and reconfigure our cities. They can improve public safety, respond to global emergencies, enhance commercial innovation, and bolster our economy.

Being an IPC'er means taking pride in what I do. It means having the great privilege of working with smart, kind, and caring people, on fascinating issues, with common purpose and commitment to advance the public interest.

Children and youth
in a digital world

Our goal is to champion the access and privacy rights of Ontario's children and youth by promoting their digital literacy and expansion of their digital rights while holding institutions accountable for protecting the children and youth they serve.

Youth Advisory Council

In September 2022, the IPC issued a call to Ontario youth, inviting them to join the IPC’s new Youth Advisory Council.

IPC on instagram

After careful deliberation, in 2022, the IPC launched an Instagram account to connect with Ontario’s children and youth. Our objective is to teach them about privacy risks and how to protect themselves online. Our account, @IPC.Ontario, is a trusted online space where young people can get useful and age-appropriate tips on how to protect their privacy online and access their records from a government institution, health care provider or children’s aid society.

Privacy Pursuit! Lesson Plans

Throughout 2022, the IPC worked with MediaSmarts, Canada’s Centre for Digital Literacy, to develop lesson plans for teachers, parents and caregivers building on the critical messages contained in Privacy Pursuit! Games and Activities for Kids.

Axe the Fax

Statistics collected by our office in 2022 revealed a continuing concern with misdirected faxes in the health sector, representing almost 38 per cent of health privacy breaches in Ontario.

Ongoing advocacy for administrative penalties

Last year, the commissioner recommended the government set out the details of PHIPA’s administrative penalty scheme in regulations. The purpose of these administrative penalties is to encourage compliance and prevent persons from deriving, directly or indirectly, any economic benefit as a result of contravening Ontario’s health privacy law or its regulations. This would enable the IPC to impose monetary consequences on the few bad actors who unfortunately undermine Ontarians’ trust in the entire health system.

We expect the government to release the proposed regulation for public comment, setting out the criteria to be considered by the IPC when imposing a penalty and the maximum dollar amounts. We look forward to seeing this regulation come into force and giving Ontarians confidence that there are effective mechanisms in place to promote positive behaviour, while stamping out the bad.

IPC and our counterparts urge governments to address the issue by coordinating a strategic plan and providing appropriate supports, such as funding or other incentives, to phase out traditional fax and unencrypted email. The resolution asks governments to promote the adoption of more modern and secure digital alternatives that are equitably available and accessible to all, and calls on health sector organizations and providers to do their part as well.

Next-generation law enforcement

Facial recognition technology

In May 2022, Canada’s federal, provincial and territorial privacy commissioners issued a joint statement, recommending a legal framework specific to facial recognition (FR) technologies. Such a law should clearly define the purposes for which police can use FR and those for which they can’t. It should also require that the use be necessary and proportionate for the proposed purpose and provide for appropriate privacy protections to mitigate the risks involved.

Next GENERATION Law Enforcement

Coroner recommendations to address intimate partner violence

In August 2022, the Office of the Chief Coroner provided the IPC with the jury recommendations of an inquest into the murders of three women in rural eastern Ontario. Recommendation 78 called on the IPC to work with the Domestic Violence Death Review Committee, justice partners, and intimate partner violence service providers to develop a plain language tool to empower intimate partner violence professionals to make informed decisions about privacy, confidentiality, and public safety. Our office readily agreed to carry out this critically-important recommendation.

Being an IPC'er means being someone who does interesting and challenging work for an organization that makes a difference in many people’s lives in terms of helping them to access or protect information that is important to them. It means being a part of a community of good people whose interests are aligned in helping the public understand the importance of access and privacy laws.

The IPC's year at a glance

Jan

Privacy Day: Empowering a New Generation of Digital Citizens

IPC concludes its review of Durham Region’s privacy breach

Feb

Reaching out to Franco-Ontarians

Mar

Remarks to Legislative Assembly on employee monitoring

Recommendations on proof of vaccination certificates in Ontario

Apr

Submission on Bill 106: Ontario Health Teams’ access to e-records

Op-Ed: Bill 88 needs to go further to protect the privacy rights of workers

May

First IPC review of an Inter-ministerial Data Integration Unit under FIPPA

IPC releases PHIPA Decision 175; Ripe for public debate: Legal and ethical issues around de-identified data

Jun

IPC invites policy consultations and sets out rules of engagement

IPC sponsors declaration at International Conference of Information Commissioners

Jul

Commissioner’s blog: Privacy and Humanity on the Brink

Aug

IPC launches secure e-appeals

Sep

IPC welcomes its first scholar-in-residence!

IPC joins national call to retire fax machines and secure digital communications in health care delivery

IPC launches Transparency Challenge

Oct

IPC updates its ransomware guidance

IPC and FPT counterparts issue joint resolution, Ensuring the Right to Privacy and Transparency in the Digital Identity Ecosystem in Canada

Nov

IPC co-led resolution on Principles and Expectations for the Appropriate Use of Personal Information in Facial Recognition Technology adopted by Global Privacy Assembly

IPC on Instagram!

Dec

Commissioner’s reflections on 2022: We listened, we learned, we did things

RESPONSIVENESS

Addressing complaints and appeals in a fair, timely and meaningful manner

More About Responsiveness

One day mediation pilot project

To streamline processes, the mediation team launched a pilot project in 2022 where parties in select sole-issue appeals were invited to participate in a half-day teleconference. The goal was to resolve the appeal during or shortly after the teleconference.

IPC introduces e-appeals

In August 2022, and as part of our efforts to modernize and provide digital services to Ontarians, the IPC launched a new service for filing and paying for appeals online, making it easier for people to file an appeal with our office — online, anytime.

Updates to M/FIPPA Code of Procedure

Throughout 2022, the IPC undertook a thorough review of its FIPPA and MFIPPA Code of Procedure and associated practice directions. These key documents that guide the appeals process had not undergone a significant review and revision since 2004.

2,574

Files Opened

2,857

Files Closed

1,258

Appeals Opened

1,347

Appeals Resolved

IPC By the Numbers

Notable examples of cases

Early resolution

Cyberattacks threaten essential services

Three school boards, one college, and two universities contacted the IPC to report a ransomware attack on guard.me. Guard.me, a third-party company providing insurance coverage to international students at these institutions, experienced a ransomware attack that affected the personal information of some of their students.

Mediation

More than meets the eye

Over two months, a city received requests from a legal clinic for information relating to poverty, homelessness, encampments, overdose prevention, and race-based data. The city denied five of the requests outright on the basis that they appeared to be frivolous or vexatious.

Privacy investigations

Selling de-identified health data \\ PHIPA 175

After learning that a health information custodian was allegedly selling de-identified personal health information to a third party, the IPC opened an investigation.

Adjudication

Multiple requests for similar information \\ MO-4241 and MO-4257

Within a relatively short period, requesters made dozens of multi-part, excessively detailed, and significantly overlapping requests for records relating to a class-action lawsuit against a town.

More About accountability

ACCOUNTABILITY

Maintaining Ontarians’ confidence in the organizational excellence of the IPC

More About ACCOUNTABILITY

Transform the IPC into a modern, digital organization

In 2022, we addressed the findings of our 2021 threat risk assessments by implementing key IT upgrades and cyber security enhancements. We launched a new online appeal service, allowing Ontarians to securely file and pay for their appeals electronically.

Being and IPC’er means delivering high-quality work in a collaborative, supportive, and professional work environment. Learning and growing professionally, every day.

IPC as an employer of choice

Throughout 2022, the IPC slowly and gradually returned staff to the office for certain in-person activities. We worked towards an eventual hybrid work model, which evolved over three phases, beginning with those activities that staff felt would be best carried out in person to promote greater employee collaboration, cohesion, and sense of community.

More About Responsiveness

Policy Advice and Consultations

Formal submissions to government

Through our advocacy work in 2022, the IPC submitted comments, open letters, and recommendations on various proposed laws and regulations having privacy implications.

Employee privacy

Before the pandemic, relatively few Canadians regularly worked from home. During the first few months of 2022, about 46 percent of employees worked from home at least some of the time. Demand for workplace monitoring and remote surveillance tools has dramatically accelerated as employers seek alternate ways of ensuring productivity and accountability in the workforce. Employee monitoring software also referred to as “bossware” — can have many different capabilities, including the ability to: monitor all computing device activity; record employees through webcams and microphones; and track employee location, movements, and activities When combined with powerful algorithms that can analyze patterns in the data and make inferences about employees’ conduct, behaviours, and even their aptitudes and sentiments, the potential for privacy invasion and discriminatory practices can become very real, very quickly.

IPC Outreach by the Numbers

as at December 31, 2022

Info matters podcasts

Commissioner blogs

Presentations

Media statements

493

Youtube subscribers

635

Media mentions

2,000

Privacy day webcast viewers

2,659

Subscribers

3,500

Info calls

4,010

Podcast downloads

4,778

Twitter followers

8,000

Info emails

9,860

LinkedIn connections

19,012

YouTube video views

152,317

Website visits

IPC By the Numbers

Spending in 2022

	Salaries and Wages	$14,900,500
	Employee Benefits	$3,980,400
	Transportation and Communications	$122,000
	Services	$3,492,400
	Supplies and Equipment	$137,000
	Total	$22,632,300

2022 Financials

The Vision
of a Modern and Effective Regulator

To be a modern and effective regulator with real-world impact

enhance Ontarians’ trust that their privacy and access rights will be respected by:

Proactively advancing their rights in key strategic areas that impact their lives

Addressing complaints and appeals in a fair, timely and meaningful manner

Maintaining their confidence in the organizational excellence of the IPC

ADVOCACY

Privacy and transparency in a modern government

Children and youth
in a digital world

Our goal is to champion the access and privacy rights of Ontario's children and youth by promoting their digital literacy and expansion of their digital rights while holding institutions accountable for protecting the children and youth they serve.

Trust in digital health

Next-generation law enforcement

The IPC's year at a glance

RESPONSIVENESS